chore(package.json): update to httpxy@0.5.3

CHANGELOG.md

@@ -3,6 +3,9 @@
 ## next
 
 - feat(definePlugin): helper function to create plugins
+- chore(package.json): update to httpxy@0.5.3
+- fix(ipv6): preserve credentials when normalizing bracketed IPv6 target string
+- fix(ipv6): unspecified IPv6 target hostname (::)"
 
 ## [v4.0.0](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0)
 

package.json

@@ -71,7 +71,7 @@
   },
   "dependencies": {
     "debug": "^4.4.3",
-    "httpxy": "^0.5.1",
+    "httpxy": "^0.5.3",
     "is-glob": "^4.0.3",
     "is-plain-obj": "^4.1.0",
     "micromatch": "^4.0.8"
@@ -98,13 +98,12 @@
     "hono": "4.12.18",
     "husky": "9.1.7",
     "lint-staged": "17.0.4",
-    "mockttp": "4.3.1",
+    "mockttp": "4.4.2",
     "msw": "2.14.5",
     "nock": "14.0.15",
     "open": "11.0.0",
     "oxfmt": "0.48.0",
     "pkg-pr-new": "0.0.71",
-    "selfsigned": "5.5.0",
     "supertest": "7.2.2",
     "typescript": "6.0.3",
     "typescript-eslint": "8.59.2",

src/utils/ipv6.ts

@@ -34,10 +34,18 @@ function normalizeIPv6ProxyTarget(target: Options['target'], optionName: 'target
   const targetUrl = toTargetUrl(target);
 
   if (targetUrl && isBracketedIPv6Hostname(targetUrl.hostname)) {
+    const normalizedHostname = normalizeIPv6DestinationHostname(stripBrackets(targetUrl.hostname));
+
     debug('normalized IPv6 "%s" %s', optionName, target);
 
+    const auth =
+      targetUrl.username || targetUrl.password
+        ? `${targetUrl.username}:${targetUrl.password}`
+        : undefined;
+
     return {
-      hostname: stripBrackets(targetUrl.hostname),
+      hostname: normalizedHostname,
+      auth,
       pathname: targetUrl.pathname,
       port: targetUrl.port,
       protocol: targetUrl.protocol,
@@ -67,3 +75,13 @@ function isBracketedIPv6Hostname(hostname: string): boolean {
 function stripBrackets(hostname: string): string {
   return hostname.replace(/^\[|\]$/g, '');
 }
+
+function normalizeIPv6DestinationHostname(hostname: string): string {
+  // The unspecified address (::) is not a routable destination for outbound client requests.
+  // Treat it as loopback so a target like http://[::]:port reaches local IPv6 listeners.
+  if (hostname === '::') {
+    debug('normalizing hostname unspecified IPv6 address (::) to loopback (::1)');
+    return '::1';
+  }
+  return hostname;
+}

test/e2e/http2-server.spec.ts

@@ -1,7 +1,7 @@
 import { createSecureServer, type Http2SecureServer } from 'node:http2';
 
 import type { Mockttp } from 'mockttp';
-import { generate } from 'selfsigned';
+import { generateCACertificate } from 'mockttp';
 import request from 'supertest';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
@@ -24,7 +24,7 @@ describe('E2E http2', () => {
     }
 
     beforeEach(async () => {
-      const cert = await generate([{ name: 'commonName', value: 'localhost' }]);
+      const cert = await generateCACertificate({ bits: 2048 });
       proxyServerCertPem = cert.cert;
 
       // Keep this dynamic to avoid a Vitest module-load ordering issue that breaks cert generation.
@@ -41,7 +41,7 @@ describe('E2E http2', () => {
 
       http2ProxyServer = createSecureServer(
         {
-          key: cert.private,
+          key: cert.key,
           cert: cert.cert,
           // Express + supertest use the HTTP/1.1 request/response API in this e2e flow.
           allowHTTP1: true,
@@ -86,7 +86,7 @@ describe('E2E http2', () => {
     }
 
     beforeEach(async () => {
-      const cert = await generate([{ name: 'commonName', value: 'localhost' }]);
+      const cert = await generateCACertificate({ bits: 2048 });
       proxyServerCertPem = cert.cert;
 
       // Keep this dynamic to avoid a Vitest module-load ordering issue that breaks cert generation.
@@ -103,7 +103,7 @@ describe('E2E http2', () => {
 
       http2ProxyServer = createSecureServer(
         {
-          key: cert.private,
+          key: cert.key,
           cert: cert.cert,
           // Express + supertest use the HTTP/1.1 request/response API in this e2e flow.
           allowHTTP1: true,

test/unit/utils/ipv6.spec.ts

@@ -47,6 +47,39 @@ describe('normalizeIPv6Targets()', () => {
     });
   });
 
+  it('should normalize unspecified bracketed IPv6 destination to loopback', () => {
+    const options: Options = {
+      target: 'http://[::]:8888/api',
+    };
+
+    normalizeIPv6LiteralTargets(options);
+
+    expect(options.target).toEqual({
+      hostname: '::1',
+      pathname: '/api',
+      port: '8888',
+      protocol: 'http:',
+      search: '',
+    });
+  });
+
+  it('should preserve credentials when normalizing bracketed IPv6 target string', () => {
+    const options: Options = {
+      target: 'http://user:pass@[::1]:8888/api',
+    };
+
+    normalizeIPv6LiteralTargets(options);
+
+    expect(options.target).toEqual({
+      auth: 'user:pass',
+      hostname: '::1',
+      pathname: '/api',
+      port: '8888',
+      protocol: 'http:',
+      search: '',
+    });
+  });
+
   it('should normalize bracketed IPv6 target URL into a target object', () => {
     const options: Options = {
       target: new URL('http://[::1]:8888/api'),