http-proxy-3 2.0.2

Fixes

• Preserve multiple Set-Cookie headers in fetch proxy responses, including older node-fetch implementations, and populate proxyRes.rawHeaders correctly (#62). Thanks to @SamyakJ05, and to @hermandsen and @jasleenkaur-qed42 for the original report and alternative fixes.
• Require follow-redirects ^1.16.1, fixing CVE-2026-111755 and CVE-2026-111756 (#65).
• Update development-only Vite/Vitest dependencies to patched versions (#65).

Release validation

Build, audit, and both native/fetch test modes passed on Node 22, 24, and 26. Published through GitHub Actions Trusted Publishing with npm provenance:

• npm package
• Successful release workflow

Node.js 22 or newer remains required, unchanged from 2.0.1. Refresh downstream lockfiles to adopt the patched dependencies.