Skip to content

deps: proxy-addr@^2.0.8 - #7474

Open
lazerg wants to merge 1 commit into
expressjs:masterfrom
lazerg:fix/issue-7473-proxy-addr
Open

lazerg wants to merge 1 commit into
expressjs:masterfrom
lazerg:fix/issue-7473-proxy-addr

Conversation

@lazerg

@lazerg lazerg commented Sep 16, 2026

Copy link
Copy Markdown

Bumps proxy-addr to ^2.0.8 to resolve CVE-2026-90711.

Fixes #7473

@lazerg

lazerg commented Sep 16, 2026

Copy link
Copy Markdown
Author

The CI failure is because proxy-addr@2.0.8 was published less than 7 days ago and .npmrc blocks new packages. It will pass once the package is older.

simonwilson4moj added a commit to ministryofjustice/hmpps-community-accommodation-tier-2-ui that referenced this pull request Sep 16, 2026
# Context

https://dsdmoj.atlassian.net/browse/SAS-1129

### proxy-addr@2.0.7

https://github.com/ministryofjustice/hmpps-community-accommodation-tier-2-ui/security/code-scanning/178
Cannot fix this due to express not having the update yet, they will do
so in around 7 days - expressjs/express#7474
So we can fix this right now by overriding the value first, then after 7
days updating express once they've got the update.

### undici@6.26.0

https://github.com/ministryofjustice/hmpps-community-accommodation-tier-2-ui/security/code-scanning/134
To fix undici I had to bump @types/node up a major version. After trying
to run the build it failed for 1 place. I tried a few different fixes
like bumping typescript or bumping the ts.config target version to
2022/24. but this creates more issues.
So i resolved the one issue instead, next bump will likely require the
rest of the typescript fixes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

update proxy-addr dependency (CVE noise prevention)

4 participants