Bump http-proxy-middleware from 2.0.7 to 2.0.9

[dependabot]

Bumps http-proxy-middleware from 2.0.7 to 2.0.9.

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.9

What's Changed

• fix(fixRequestBody): check readableLength by @​chimurai in chimurai/http-proxy-middleware#1097
• chore(package): v2.0.9 by @​chimurai in chimurai/http-proxy-middleware#1099

Full Changelog: chimurai/http-proxy-middleware@v2.0.8...v2.0.9

v2.0.8

What's Changed

• fix(fixRequestBody): prevent multiple .write() calls by @​chimurai in chimurai/http-proxy-middleware#1090
• fix(fixRequestBody): handle invalid request by @​chimurai in chimurai/http-proxy-middleware#1091
• chore(package): v2.0.8 by @​chimurai in chimurai/http-proxy-middleware#1094

Full Changelog: chimurai/http-proxy-middleware@v2.0.7...v2.0.8

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.9

• fix(fixRequestBody): check readableLength

v2.0.8

• fix(fixRequestBody): prevent multiple .write() calls
• fix(fixRequestBody): handle invalid request

Commits

• 617a7c9 chore(package): v2.0.9 (#1099)
• d22d587 fix(fixRequestBody): check readableLength (#1097)
• d03d51b chore(package): v2.0.8 (#1094)
• c50dd06 fix(fixRequestBody): handle invalid request (#1091)
• 76a9d8d fix(fixRequestBody): prevent multiple .write() calls (#1090)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[cursor]

Stale comment

Dependabot review: http-proxy-middleware 2.0.7 → 2.0.9

Verdict: Safe to merge. Lockfile-only patch bump; no application code changes.

Testing

• CI: lint, unit test, and test-cypress all passed on this branch.
• Local: Could not run tests here (yarn install failed with TLS/network errors). CI results used instead.

Scope

• Transitive dependency of webpack-dev-server@5.1.0 (devDependency).
• Not bundled into production output.
• webpack.config.js does not configure devServer.proxy, and src/setupProxy.js is not present.

Safety of merging — concerns unlikely to be caught by tests

• Dev-server proxy edge cases: 2.0.8–2.0.9 harden fixRequestBody (addresses CVE-2025-32997 / GHSA-9gqv-wp59-fq42). Existing tests do not exercise proxied POST bodies or bodyParser failure paths.
• Future proxy usage: If a setupProxy.js or devServer.proxy config is added later, proxy behaviour would need manual verification — not covered today.

Proposed fixes

None. No test failures, deprecations, or code changes required.

  

_{Sent by Cursor Automation: Editor-* - Tests Dependabot PRs}

[cursor]

Dependabot assessment: http-proxy-middleware 2.0.7 → 2.0.9

Verdict: safe to merge.

Lockfile-only patch bump. The package is a transitive dependency of webpack-dev-server@5.1.0; this repo does not import it directly, and webpack.config.js has no devServer.proxy config (no src/setupProxy.js either). The 2.0.8/2.0.9 changes are bug fixes in fixRequestBody only.

Testing

• CI: lint, unit tests, Cypress e2e, and production build all passed.
• Local: yarn install failed here due to a transient TLS/network error, so verification relied on CI.

Concerns unlikely to be caught by tests

• No proxy in use today — the fixRequestBody fixes do not affect current dev-server behaviour; they would only matter if devServer.proxy (or setupProxy.js) is added later for proxied POST/PUT requests with parsed bodies.
• WebSocket upgrade paths — http-proxy-middleware is also used internally for dev-server WebSocket proxying; impact is minimal here because hot: false (only liveReload: true).

Proposed fixes

None — no test failures, deprecations, or code changes required.

  

_{Sent by Cursor Automation: Editor-* - Tests Dependabot PRs}