update proxy-addr dependency (CVE noise prevention)

[hoerup]

current express depends on proxy-addr 2.0.7 which is vulnerable to https://www.cve.org/CVERecord?id=CVE-2026-90711

please update to 2.0.8

[krzysdz]

Since the version is specified as ^2.0.7 in 5.x and ~2.0.7 in 4.x, which are compatible with 2.0.8, you can run npm update proxy-addr to update it in your project.

express/package.json

Line 54 in 9a34acf

"proxy-addr": "^2.0.7",

express/package.json

Line 55 in 899b524

"proxy-addr": "~2.0.7",

[UlisesGascon]

Do you want to create the PRs for it (5.x and 4.x lines) @hoerup?

I totally agree with @krzysdz but is also a good first contribution to the project