refactor: Bump proxy-addr from 2.0.7 to 2.0.8

[mtrezza]

Closes #3147

Security update for a transitive development dependency (express@5.2.1 -> proxy-addr). Lock file change only; proxy-addr is not part of the production dependency tree.

Changes

• 2.0.8: Fixed CVE-2026-90711 (GHSA-jqcg-44mw-7w3h), IP spoofing via IPv4-mapped IPv6 trust subnets. Trust matching now canonicalizes IPv4-mapped candidate addresses to IPv4, only lets an IPv6 subnet match IPv4 addresses if it is an IPv4-mapped subnet with a prefix of at least 96, and no longer matches native IPv6 addresses against IPv4-mapped subnets (jshttp/proxy-addr@780911d, released in Release: 2.0.8 jshttp/proxy-addr#70).
• 2.0.8: Added funding metadata to package.json; all other changes are CI, tooling, and documentation only.

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement. The public API (proxyaddr(), proxyaddr.all(), proxyaddr.compile()) used by express is unchanged, and this repository does not configure a trust proxy setting.

Summary by CodeRabbit

• Chores
  • Updated the underlying address-handling component to a newer version. Its platform requirements remain unchanged, and this update does not introduce any new user-facing features.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 3f553199-2a6c-4fbb-8f44-f7d787e567a5

📥 Commits

Reviewing files that changed from the base of the PR and between 560db76 and 510949f.

📒 Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

📝 Walkthrough

The lockfile updates proxy-addr from version 2.0.7 to 2.0.8. The package entry adds Open Collective funding metadata.

Changes: proxy-addr update

Layer / File(s)	Summary
Update the lockfile entry package-lock.json	The package entry and dependency summary update proxy-addr to version 2.0.8 with new registry URLs and integrity hashes. The package entry adds Open Collective funding metadata. Its dependencies and Node.js engine requirement remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 51094

The patched version is selected for development installs, and production dependencies are unaffected. No actionable merge risk remains.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title begins with the allowed prefix refactor:. The first letter after the prefix is capitalized, and the title accurately describes the dependency upgrade.
Description check		The description clearly identifies the issue, explains the upgrade approach, documents the security fix, and states the impact and breaking-change status. It omits the template headings, links, and ta…
Linked Issues check		Issue #3147 requires proxy-addr 2.0.8 and remediation of CVE-2026-90711. The whole-PR diff updates both lockfile entries from 2.0.7 to 2.0.8 and records the matching 2.0.8 tarball and integrity valu…
Out of Scope Changes check		The PR changes only package-lock.json. The added license and funding metadata are package metadata associated with the upgraded lockfile entry. The dependency declarations and engine requirement…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		PASS. The PR changes only package-lock.json. It replaces proxy-addr 2.0.7 with 2.0.8 using the npm registry URL and a new integrity hash, while preserving its dependencies. Both lockfile records are c…
Engage In Review Feedback		No review feedback comments were supplied, and the current review produced zero actionable findings. Therefore, there was no feedback requiring engagement, implementation, or discussion.

Full details: Description check

Explanation

The description clearly identifies the issue, explains the upgrade approach, documents the security fix, and states the impact and breaking-change status. It omits the template headings, links, and task checkboxes, but the required substantive information is present.

Full details: Linked Issues check

Explanation

Issue #3147 requires proxy-addr 2.0.8 and remediation of CVE-2026-90711. The whole-PR diff updates both lockfile entries from 2.0.7 to 2.0.8 and records the matching 2.0.8 tarball and integrity value. This supplies the requested dependency remediation. No source-code or test changes are required by the issue.

Full details: Out of Scope Changes check

Explanation

The PR changes only package-lock.json. The added license and funding metadata are package metadata associated with the upgraded lockfile entry. The dependency declarations and engine requirement remain unchanged. No unrelated product code or behavior changes are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

PASS. The PR changes only package-lock.json. It replaces proxy-addr 2.0.7 with 2.0.8 using the npm registry URL and a new integrity hash, while preserving its dependencies. Both lockfile records are consistent, and the package remains dev-only. No application code or security-sensitive configuration changed. The added funding metadata does not create a security vulnerability.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.98%. Comparing base (560db76) to head (510949f).

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha    #3151   +/-   ##
=======================================
  Coverage   99.98%   99.98%           
=======================================
  Files          64       64           
  Lines        6339     6339           
  Branches     1522     1538   +16     
=======================================
  Hits         6338     6338           
  Misses          1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.