Bump http-proxy-middleware from 1.0.5 to 2.0.7

[tdonohue]

References

• Fixes CVE-2024-21536

Description

Bump http-proxy-middleware from 1.0.5 to 2.0.7.

Tested that v2.0.7 works well with DSpace.

In the DSpace UI, this http-proxy-middleware is ONLY used for loading Sitemaps (e.g. [dspace.ui.url]/sitemap_index.html when generated) and Signposting (embedded in Item pages under [dspace.ui.url]/signposting/* URLs)

Instructions for Reviewers

• Verify all automated tests pass
• If desired, test Sitemap and Signposting URLs (as described above). I've tested both and they work well after this update

[kshepherd]

Note, there are also some small changes to package-lock.json for unrelated dependencies, changing dev to devOptional. The npm package.json docs say:

dev, optional, devOptional: If the package is strictly part of the devDependencies tree, then dev will be true. If it is strictly part of the optionalDependencies tree, then optional will be set. If it is both a dev dependency and an optional dependency of a non-dev dependency, then devOptional will be set. (An optional dependency of a dev dependency will have both dev and optional set.)

Everything works in testing though, so perhaps the changes to the dependency tree (removing that other version of http-proxy-middleware) altered things so the dep is not strict anymore?

[kshepherd]

+1 tests well and looks good (i made a note about some other changes to package-lock.json but they don't seem to be a problem and probably just are a result of the dep tree being cleaner) thanks @tdonohue !

[tdonohue]

Regarding the changes to package-lock.json mentioned above...those modifications were automated by npm itself when I upgraded this dependency by running npm install http-proxy-middleware@^2.0.7.

So, I think you are correct, @kshepherd that it's simply npm doing some optimization / cleanup of its own after this upgrade.

[dspace-bot]

Backport failed for dspace-8_x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin dspace-8_x
git worktree add -d .worktree/backport-3550-to-dspace-8_x origin/dspace-8_x
cd .worktree/backport-3550-to-dspace-8_x
git switch --create backport-3550-to-dspace-8_x
git cherry-pick -x 693adc7cfc8467b33f4bf4614ee33a0095a1f773

[tdonohue]

The failed automated backport to 8.x above is expected.

This PR was manually ported to both 8.x and 7.x:

• 8.x port: [Port dspace-8_x] Bump http-proxy-middleware from 1.0.5 to 2.0.7 #3551
• 7.x port: [Port dspace-7_x] Bump http-proxy-middleware from 1.0.5 to 2.0.7 #3552