Repository navigation
fix: Bump proxy-addr from 2.0.7 to 2.0.8 - #959
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update proxy-addr lockfile entry package-lock.json |
The package entry and dependency tree entry now specify proxy-addr version 2.0.8. The package entry adds Open Collective funding metadata. |
Priority:
Estimated code review effort: 2 (Simple) | ~5 minutes
Merge Risk: 
302cc
-
No actionable merge-blocking risk was identified.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed fix:prefix. The first letter after the prefix is capitalized, and the title accurately describes theproxy-addrdependency update.Linked Issues check Issue #948has two coding requirements: (1) upgrade proxy-addr from 2.0.7 to 2.0.8, and (2) include the upstream fix for CVE-2026-90711. The diff of package-lock.json against the merge base confirms b…Out of Scope Changes check The whole-PR diff touches only package-lock.json. Its changes are the proxy-addr version, resolved URL, and integrity fields in both lock sections. The other edits are the license and funding metadata… Security Check The pull request changes only package-lock.json. It upgrades the transitive production dependencyproxy-addrfrom 2.0.7 to 2.0.8, with a new registry URL and integrity hash. The dependency remains…Engage In Review Feedback The current review produced zero actionable findings, and no review threads were returned. Therefore, there was no review feedback requiring engagement, implementation, or discussion. Full details: Linked Issues check
-
Explanation
Issue
#948has two coding requirements: (1) upgrade proxy-addr from 2.0.7 to 2.0.8, and (2) include the upstream fix for CVE-2026-90711. The diff of package-lock.json against the merge base confirms both lock entries changed from 2.0.7 to 2.0.8 (the node_modules/proxy-addr entry and the v1 proxy-addr entry). The resolved URLs point to proxy-addr-2.0.8.tgz, and the integrity hash changed to sha512-5nnx0yGy...AVyQ==. The fix ships in 2.0.8, as stated in the PR description. The repository does not contain the proxy-addr source. The fix is therefore established by the pinned version, not by a code line in this diff. No coding requirement is left unmet. No automated test was requested by the issue.
Full details: Out of Scope Changes check
-
Explanation
The whole-PR diff touches only package-lock.json. Its changes are the proxy-addr version, resolved URL, and integrity fields in both lock sections. The other edits are the license and funding metadata that come with proxy-addr 2.0.8. The reported counts (+11/-6) match this scope. No other package entries changed. The PR description notes that the Dependabot lock also removes mongodb optional peer entries. This PR does not make that removal, so it does not add an unrelated change. All changes connect directly to the
#948upgrade.
Full details: Security Check
-
Explanation
The pull request changes only
package-lock.json. It upgrades the transitive production dependencyproxy-addrfrom 2.0.7 to 2.0.8, with a new registry URL and integrity hash. The dependency remains under Express 5.2.1, and itsforwardedandipaddr.jsdependencies are unchanged. No application code or new security-sensitive pattern was introduced.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
## [3.1.2](3.1.1...3.1.2) (2026-10-26) ### Bug Fixes * Bump proxy-addr from 2.0.7 to 2.0.8 ([#959](#959)) ([9d86153](9d86153))
Closes #948
Fixes Dependabot alert 465 (critical, runtime): GHSA-jqcg-44mw-7w3h / CVE-2026-90711, "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet". Affected versions are
>= 1.1.0, < 2.0.8; the fix is in 2.0.8.proxy-addris a transitive production dependency (express@5.2.1→proxy-addr), so only the lock file changes.Changes
::ffff:10.0.0.1or::ffff:a00:1) is converted to IPv4 before it is matched.::ffff:10.0.0.0/104). Before, a mapped subnet with a short prefix (e.g.::ffff:10.0.0.0/8) or a native IPv6 subnet that covers::ffff:0:0/96(e.g.::/64) trusted every IPv4 and IPv4-mapped address.::1under::ffff:127.0.0.0/8).fundingadded topackage.json(chore: add funding to package.json jshttp/proxy-addr#40), and a README typo fix (Fix "arugment" typo in README jshttp/proxy-addr#61). The runtime dependencies (forwarded0.2.0,ipaddr.js1.9.1) andengines(node >= 0.10) are unchanged.Breaking Changes
None
Code Changes Required
None — the upgrade is a drop-in replacement.
The changed code runs only when Express's
trust proxysetting is a list of addresses or subnets. This app doesn't settrust proxy, so Express uses its defaultfalse. Parse Server applies itstrustProxyoption only inParseServer.startApp(the CLI), not whenserver.appis mounted on this app's Express instance. A comparison of 2.0.7 and 2.0.8 with Express 5.2.1 found identicalreq.ip,req.ips,req.protocolandreq.hostnameresults for the default setting,true, hop counts, theloopback,linklocalanduniquelocalpresets, IPv4 subnets, native IPv6 subnets that don't cover the IPv4-mapped range (e.g.fe80::/10,fc00::/7,2001:db8::/32,::/96), and IPv4-mapped subnets with a prefix of 96 or more.In 2.0.8, IPv4 and IPv4-mapped clients match an IPv6 trust entry only if it is an IPv4-mapped subnet with a prefix of at least 96, and native IPv6 clients never match an IPv4-mapped trust entry. Every difference makes trust stricter, which is the fix itself. A deployment that sets
trust proxyto one of these entries is affected:::ffff:0:0/96no longer trusts IPv4 or IPv4-mapped clients. Examples are::/64,::/80,::/1, prefixes 81 to 95 such as::fffe:0:0/95and::8000:0:0/81, and entries with non-zero host bits such as::1/64.::ffff:10.0.0.0/8) no longer trusts IPv4 or IPv4-mapped clients, nor native IPv6 clients inside it (e.g.::1under::ffff:127.0.0.0/8).Write IPv4 trust entries as IPv4 subnets (e.g.
10.0.0.0/8) or as IPv4-mapped subnets with a prefix of 96 or more (e.g.::ffff:10.0.0.0/104).Lock file
Dependabot's lock in #948 also removes the lock entries for
mongodb's optional peer dependencies (gcp-metadatawith its nestedgaxiosandnode-fetch,smart-bufferandsocks), which accounts for its additional deletions. This PR instead uses a lock regenerated withnpm update proxy-addron the currentmaster, which changes only theproxy-addrentries (2.0.7 → 2.0.8).Summary by CodeRabbit