proxy-addr 2.0.8 (critical GHSA-jqcg-44mw-7w3h: IP spoofing via IPv4-mapped IPv6). (#36)

OP OpenVibers committed 7 Oct 2026 · 198a7a7cc7 · 1 file, +7 −3

proxy-addr 2.0.7 -> 2.0.8 in package-lock.json only (express pins ~2.0.7, so no package.json change): GHSA-jqcg-44mw-7w3h, critical, IP spoofing via an IPv4-mapped IPv6 address against a trusted subnet, which decides req.ip behind the proxy. CI dependency audit fails at critical, so every PR here was blocked by it. The other Node services already resolve 2.0.8. Generated with npm update proxy-addr --package-lock-only; the diff is that one entry.

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex 2d74adde..8051d381 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -3094,9 +3094,9 @@
        "license": "MIT"
      },
      "node_modules/proxy-addr": {
--      "version": "2.0.7",
--      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
--      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
++      "version": "2.0.8",
++      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
++      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
        "license": "MIT",
        "dependencies": {
          "forwarded": "0.2.0",
@@@ -3104,6 +3104,10 @@
        },
        "engines": {
          "node": ">= 0.10"
++      },
++      "funding": {
++        "type": "opencollective",
++        "url": "https://opencollective.com/express"
        }
      },
      "node_modules/pump": {