[Snyk] Upgrade http-proxy from 1.17.0 to 1.18.1

[lilmoonlil]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade http-proxy from 1.17.0 to 1.18.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 2 versions ahead of your current version.
• The recommended version was released 4 years ago, on 2020-05-17.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Arbitrary File Overwrite SNYK-JS-TAR-1536528	410/1000 Why? CVSS 8.2	No Known Exploit
	Arbitrary File Overwrite SNYK-JS-TAR-1536531	410/1000 Why? CVSS 8.2	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579147	410/1000 Why? CVSS 8.2	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579152	410/1000 Why? CVSS 8.2	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579155	410/1000 Why? CVSS 8.2	No Known Exploit
	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	410/1000 Why? CVSS 8.2	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	410/1000 Why? CVSS 8.2	Proof of Concept
	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-INI-1048974	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-MIXINDEEP-450212	410/1000 Why? CVSS 8.2	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-SETVALUE-1540541	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-SETVALUE-450213	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-SETVALUE-1540541	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-SETVALUE-450213	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-MINIMIST-559764	410/1000 Why? CVSS 8.2	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	410/1000 Why? CVSS 8.2	Proof of Concept
	Denial of Service (DoS) SNYK-JS-HTTPPROXY-569139	410/1000 Why? CVSS 8.2	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	410/1000 Why? CVSS 8.2	No Known Exploit
	Prototype Pollution SNYK-JS-MINIMIST-559764	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-MINIMIST-2429795	410/1000 Why? CVSS 8.2	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	410/1000 Why? CVSS 8.2	No Known Exploit
	Validation Bypass SNYK-JS-KINDOF-537849	410/1000 Why? CVSS 8.2	Proof of Concept
	Prototype Pollution SNYK-JS-MINIMIST-2429795	410/1000 Why? CVSS 8.2	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: http-proxy

• 1.18.1 - 2020-05-17
  

  1.18.1

• 1.18.0 - 2019-09-18
  

  Version 1.18.0

• 1.17.0 - 2018-04-20
  

  Due to some great contributions I'm happy to announce a new release of http-proxy containing numerous bug fixes, feature additions and documentation improvements. Thanks to all who contributed for their patience and willingness to contribute despite perceived stagnation in activity in the project. I welcome all contributions and those who are interested in getting more involved with the project. Below I will highlight the changes that landed in the latest version but you can find the full diff of the changes in #1251

  • Add option to rewrite path of set-cookie headers. @ swillis12
  • Add option for overriding http METHOD when proxying request @ AydinChavez
  • Feature: selfHandleResponse for taking responsibility in returning your own response when listening on the proxyRes event. @ cpd0101 @ guoxiangyang
  • Add followRedirects option @ n30n0v
  • Document timeout option @ jlaamanen
  • Fix documentation typos @ carpsareokiguess
  • Document buffer option @ jonhunter1977
  • Include websocket non-upgrade response instead of just closing the socket. Allows auth schemes to be possible with websocket proxying. @ Tigge
  • Stop using the writeHead method explicitly and let node handle it internally to prevent thrown errors @ jakefurler
  • Be more defensive in handling of detecting response state when proxying @ thiagobustamante

from http-proxy GitHub release notes

Commit messages

Package name: http-proxy

• 9b96cd7 1.18.1
• 335aeeb Skip sending the proxyReq event when the expect header is present (Server is started at 5500 but failed to open browser. Try to change the CustomBrowser settings. ritwickdey/vscode-live-server#1447)
• dba3966 Remove node6 support, add node12 to build (Live Server unresponsive, high latency, high resouce and stopping other extensions. ritwickdey/vscode-live-server#1397)
• 9bbe486 [dist] Version bump. 1.18.0
• 6e4bef4 Added in auto-changelog module set to keepachangelog format (Extension issue ritwickdey/vscode-live-server#1373)
• d056241 fix 'Modify Response' readme section to avoid unnecessary array copying (Extension issue ritwickdey/vscode-live-server#1300)
• 244303b Fix incorrect target name for reverse proxy example (live server performance issue  ritwickdey/vscode-live-server#1135)
• b4028ba Fix modify response middleware example (Extension issue ritwickdey/vscode-live-server#1139)
• 77a9815 [dist] Update dependency async to v3 (Extension issue ritwickdey/vscode-live-server#1359)
• c662f9e Fix path to local http-proxy in examples. (Extension issue ritwickdey/vscode-live-server#1072)
• 806e492 fix reverse-proxy example require path (Cant open the written code in browser. ritwickdey/vscode-live-server#1067)
• c8fa599 Update README.md (Extension issue ritwickdey/vscode-live-server#970)
• 0d9ed36 [dist] Update dependency request to ~2.88.0 [SECURITY] (Extension issue ritwickdey/vscode-live-server#1357)
• 9d75b98 [dist] Update dependency eventemitter3 to v4 (Extension issue ritwickdey/vscode-live-server#1365)
• 192b2b9 [dist] Update dependency colors to v1 (Extension issue ritwickdey/vscode-live-server#1360)
• 4a657a7 [dist] Update all non-major dependencies (cannot open live server with chrome ritwickdey/vscode-live-server#1356)
• 7a154f8 [dist] Update dependency agentkeepalive to v4 (Extension issue ritwickdey/vscode-live-server#1358)
• 749eec6 [dist] Update dependency nyc to v14 (htaccess ritwickdey/vscode-live-server#1367)
• e588213 [dist] Update dependency concat-stream to v2 (Extension issue ritwickdey/vscode-live-server#1363)
• 59c4403 [fix] Latest versions.
• dd1d08b [fix test] Update tests.
• 16d4f8a [dist] Regenerate package-lock.json.
• fc93520 [dist] .gitattributes all the things.
• 7e4a0e5 [dist] New test fixtures.

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs