Skip sending the proxyReq event when the expect header is present

[jsmylnycky]

Hotfix for https://www.npmjs.com/advisories/1486

Expecting build error due to Node 6. Waiting for #1397 to be merged to have a clean CI build.

[alexgvozden]

will anyone merge this if it solves the issue?

[amitmula]

Any ETA on when this is getting merged ?

[Hypnosphi]

@indexzero @jcrugzz looks like this requires your immediate attention

[indexzero]

My children are the only thing that requires immediate attention, sorry. Software happens during normal working hours. Didn't get to this on Friday, therefore it will be tomorrow.

Jarrett may have a moment, I have asked him.

[jcrugzz]

@jsmylnycky thanks for the work here. Will release this fix in a few

[jcrugzz]

published as 1.18.1

[fabb]

Have you informed npm support to whitelist this version? Currently it‘s still blacklisted: https://www.npmjs.com/advisories/1486/versions
The support usually resolves such inquiries within a few hours: security@npmjs.com

[Hypnosphi]

@indexzero that's understandable, sorry for my wording. But the vulnerability seems reported almost 3 months ago. Do you consider adding more core maintainers as an option?

[jsmylnycky]

@Hypnosphi If you take a look at the top of the Issues page, there's two pinned posts going back to Aug/Sept, basically looking to get more people active with the future of this project. There's been very little activity from folks willing to actually jump in and contribute tho. If it is something you're interested in doing, I suggest you take a look at those posts and leave some comments to get in touch :)

[Lucidiot]

Just out of curiosity, was the vulnerability actually reported to the maintainers? This would not be the first time nobody knows about the issue until the advisory goes public: sass/node-sass#2816 (comment)

[hendrikmolder]

Have you informed npm support to whitelist this version? Currently it‘s still blacklisted: https://www.npmjs.com/advisories/1486/versions
The support usually resolves such inquiries within a few hours: security@npmjs.com

They've now marked the fixed version as unaffected