[dependabot]

Bumps proxy-addr from 2.0.7 to 2.0.8.

Release notes

Sourced from proxy-addr's releases.

2.0.8

Important

• Fix CVE-2026-90711 (GHSA-jqcg-44mw-7w3h)

What's Changed

• Add OSSF scorecard action by @​carpasse in jshttp/proxy-addr#27
• Fix ci pipeline and add missing Node.JS versions by @​carpasse in jshttp/proxy-addr#26
• [StepSecurity] Apply security best practices by @​step-security-bot in jshttp/proxy-addr#29
• build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 by @​dependabot[bot] in jshttp/proxy-addr#30
• build(deps): bump github/codeql-action from 2.23.2 to 3.28.18 by @​dependabot[bot] in jshttp/proxy-addr#31
• build(deps-dev): bump eslint-plugin-import from 2.23.4 to 2.31.0 by @​dependabot[bot] in jshttp/proxy-addr#32
• build(deps): bump ossf/scorecard-action from 2.0.6 to 2.4.2 by @​dependabot[bot] in jshttp/proxy-addr#33
• build(deps): bump actions/upload-artifact from 3.1.3 to 4.6.2 by @​dependabot[bot] in jshttp/proxy-addr#35
• build(deps-dev): bump deep-equal from 1.0.1 to 1.1.2 by @​dependabot[bot] in jshttp/proxy-addr#34
• build(deps-dev): bump eslint-plugin-markdown from 2.2.0 to 2.2.1 by @​dependabot[bot] in jshttp/proxy-addr#36
• chore: add funding to package.json by @​Phillip9587 in jshttp/proxy-addr#40
• build(deps): bump github/codeql-action from 3.28.18 to 3.29.5 by @​dependabot[bot] in jshttp/proxy-addr#41
• build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by @​dependabot[bot] in jshttp/proxy-addr#43
• build(deps): bump actions/checkout from 3.6.0 to 5.0.0 by @​dependabot[bot] in jshttp/proxy-addr#42
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @​dependabot[bot] in jshttp/proxy-addr#47
• build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by @​dependabot[bot] in jshttp/proxy-addr#46
• build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @​dependabot[bot] in jshttp/proxy-addr#50
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by @​dependabot[bot] in jshttp/proxy-addr#49
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in jshttp/proxy-addr#48
• build(deps): bump actions/checkout from 6.0.0 to 6.0.2 by @​dependabot[bot] in jshttp/proxy-addr#56
• build(deps): bump github/codeql-action from 4.31.5 to 4.32.0 by @​dependabot[bot] in jshttp/proxy-addr#55
• build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @​dependabot[bot] in jshttp/proxy-addr#57
• build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 by @​dependabot[bot] in jshttp/proxy-addr#58
• Fix "arugment" typo in README by @​schiwekM in jshttp/proxy-addr#61
• build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 by @​dependabot[bot] in jshttp/proxy-addr#64
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @​dependabot[bot] in jshttp/proxy-addr#63
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in jshttp/proxy-addr#45
• build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by @​dependabot[bot] in jshttp/proxy-addr#39
• chore(ci): npm-publish via reusable workflows by @​sheplu in jshttp/proxy-addr#54
• refresh CI by @​UlisesGascon in jshttp/proxy-addr#69
• fix: typo by @​UlisesGascon in jshttp/proxy-addr#71
• Release: 2.0.8 by @​UlisesGascon in jshttp/proxy-addr#70

New Contributors

• @​carpasse made their first contribution in jshttp/proxy-addr#27
• @​step-security-bot made their first contribution in jshttp/proxy-addr#29
• @​dependabot[bot] made their first contribution in jshttp/proxy-addr#30
• @​Phillip9587 made their first contribution in jshttp/proxy-addr#40
• @​schiwekM made their first contribution in jshttp/proxy-addr#61
• @​sheplu made their first contribution in jshttp/proxy-addr#54

Full Changelog: jshttp/proxy-addr@v2.0.7...v2.0.8

Changelog

Sourced from proxy-addr's changelog.

2.0.8

• Fix CVE-2026-90711 (GHSA-jqcg-44mw-7w3h)

Commits

• a11ad82 2.0.8 (#70)
• 780911d fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix
• 92e103e fix(ci): use publised as release trigger event (#71)
• 3e5ac75 ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)
• 4b9db81 chore(ci): npm-publish via workflows (#54)
• 655e895 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)
• 50ce4d0 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)
• 0fd347f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)
• 6a517fa build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)
• 0d45e2a Fix "arugment" typo in README (#61)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.

[tangletools]

✅ Auto-approved PR — 9422cdd5

Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-22T19:30:54Z}

[drewstone]

Owner: op-company:cve-deps (live Fleet lane owning the dependency campaign; stale-PR handoff from op-company:pr-closer, 2026-10-23)
Blocker: This is one of a wave of Dependabot PRs opened 2026-10-22 19:30–19:56Z. The campaign runs one coherent dependency PR per repo, and campaign CI admission is capped at two repos at a time. This bump has no exact-head integration proof recorded yet.
Next action: When the repo gets a CI slot, fold this bump into the repo's coherent dependency PR, or qualify it on its own through the repo's maintained gate. Close it with supersession proof once a merged PR contains the same or a newer version. This handoff authorizes no merge.

[drewstone]

@dependabot rebase

[tangletools]

✅ Auto-approved PR — 3fe6bd47

Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-24T00:44:53Z}