[Security] Bump http-proxy from 1.18.0 to 1.18.1

[dependabot-preview]

Bumps http-proxy from 1.18.0 to 1.18.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Denial of Service in http-proxy Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

For a proxy server running on http://localhost:3000, the following curl request triggers the unhandled exception:
curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"

Recommendation

Upgrade to version 1.18.1 or later

Affected versions: < 1.18.1

Changelog

Sourced from http-proxy's changelog.

v1.18.1 - 2020-05-17

Merged

• Skip sending the proxyReq event when the expect header is present [#1447](https://github.com/http-party/node-http-proxy/issues/1447)
• Remove node6 support, add node12 to build [#1397](https://github.com/http-party/node-http-proxy/issues/1397)

Commits

• 9b96cd7 1.18.1
• 335aeeb Skip sending the proxyReq event when the expect header is present (#1447)
• dba3966 Remove node6 support, add node12 to build (#1397)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (develop@bdffa3b). Click here to learn what that means.
The diff coverage is 89.35%.

❗ Current head 22f7239 differs from pull request most recent head 590cfdd. Consider uploading reports for the commit 590cfdd to get more accurate results

@@            Coverage Diff             @@
##             develop     #489   +/-   ##
==========================================
  Coverage           ?   90.79%           
==========================================
  Files              ?      118           
  Lines              ?     2215           
  Branches           ?      661           
==========================================
  Hits               ?     2011           
  Misses             ?      204           
  Partials           ?        0           

Impacted Files	Coverage Δ
.../manual-trigger/register-manual-trigger-watcher.js	100.00% <ø> (ø)
...play-conditions/scroll/register-element-watcher.js	0.00% <0.00%> (ø)
src/rollup/utils/persist/erase.js	0.00% <0.00%> (ø)
src/rollup/utils/utils.js	100.00% <ø> (ø)
src/rollup/utils/get-scrolling-element.js	6.66% <6.66%> (ø)
src/rollup/data/tracking/track-widget-action.js	88.00% <50.00%> (ø)
...display-conditions/exit-intent/init-exit-intent.js	73.68% <73.68%> (ø)
src/rollup/validation/validate-widget-position.js	84.21% <75.00%> (ø)
src/rollup/widgets/show-widget.js	75.75% <81.81%> (ø)
src/rollup/recommendations/recommend-content.js	73.91% <93.75%> (ø)
... and 32 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bdffa3b...590cfdd. Read the comment docs.