fix(deps): bump proxy-addr to 2.0.8 (GHSA-jqcg-44mw-7w3h)

[danibsheehan]

Summary

• verify / audit (service) started failing on every PR (e.g. chore(deps-dev): Bump eslint from 10.11.0 to 10.12.0 in /service in the npm-minor-and-patch group across 1 directory #284) because a critical advisory was published for proxy-addr ≤ 2.0.7 (GHSA-jqcg-44mw-7w3h, IP spoofing via IPv4-mapped IPv6 trust subnets). It is a transitive dependency via express, locked at 2.0.7 on main.
• Bumps the lockfile entry to 2.0.8, which is within express's existing ^2.0.7 range. Lockfile-only; no package.json or other package changes. Generated with npm 11 so the lockfile's libc fields are left untouched.

How to verify

In service/: npm ci && npm audit --audit-level=high → 0 vulnerabilities. npm run lint, npm run test:run, npm run build and npm run format:check all pass.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/proxy-addr	2.0.8	🟢 7.3	Details Check Score Reason Maintained 🟢 8 10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8 Binary-Artifacts 🟢 10 no binaries found in the repo Dependency-Update-Tool 🟢 10 update tool detected Code-Review 🟢 5 Found 4/7 approved changesets -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found SAST 🟢 8 SAST tool detected but not run on all commits Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 9 security policy file detected Contributors 🟢 10 project has 6 contributing companies or organizations CI-Tests 🟢 6 19 out of 29 merged PRs checked by a CI test -- score normalized to 6

Scanned Files

• service/package-lock.json

[github-actions]

PR guide

Auto-generated from changed paths. Fill in Summary and How to verify in the PR description above.

Touches: tooling config

Diff: 1 file changed, 7 insertions(+), 3 deletions(-)

Suggested verify

• npm run lint
• npm run format:check
• npm run test:run or targeted Vitest files for the changed area
• npm run build

Checklist (applies to this PR)

• No unintended secrets or local-only config committed

Reviewer focus

• Dependency, Vite, TypeScript, ESLint, and Prettier changes that can affect local and CI runs

Commits

• be77e07 fix(deps): bump proxy-addr to 2.0.8 (GHSA-jqcg-44mw-7w3h)

Files by area

Area	Files
tooling config	1

CI

Required checks: verify runs format/lint/audit/typecheck/test/build as separate per-concern checks for every PR. Coverage tables are posted separately.

---

Template: pull_request_template.md

[github-actions]

Lighthouse CI report

• http://localhost:37845/index.html

Thresholds are informational (warn-level) for now; see ./.lighthouserc.json.