http-proxy-middleware
The one-liner node.js proxy middleware for connect, express, next.js and more
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed from chimurai personal account to GitHub Actions CI/CD with SLSA provenance — this is the expected result of adopting automated publishing from the same repo. | ai | |
| dependencies | unvetted-dep:http-proxy | AI (dependencies): http-proxy is the core dependency this package is built upon; it has been a stable, expected dependency throughout the package's history. | ai | |
| dependencies | unvetted-dep:@types/http-proxy | AI (dependencies): @types/http-proxy provides TypeScript type definitions for http-proxy; a legitimate and expected runtime dependency for this TypeScript-based package. | ai | |
| phantom-deps | phantom-dep:@types/http-proxy | AI (phantom-deps): @types/http-proxy is intentionally a runtime dep here to expose TypeScript types to consumers; not a true phantom dependency for this package. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 4.1.1 | 5 / 32 | |
| 4.1.0 | 5 / 32 | |
| 4.0.0 | 5 / 32 | |
| 3.0.7 | 6 / 31 | |
| 3.0.6 | 6 / 31 | |
| 3.0.5 | 6 / 32 | |
| 2.0.9 | 5 / 29 | |
| 4.0.0-beta.3 | 5 / 32 | |
| 4.0.0-beta.2 | 5 / 30 | |
| 4.0.0-beta.0 | 5 / 31 |
v4.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.