chore(deps): Plane plugin 0.1.12 — the proxy forwards the client's address

Merged
EV
18d ago
+11-11

Bumps @ever-gauzy/plugin-integration-plane-api and -models to 0.1.12, released from ever-co/ever-gauzy-plugins-plane#308 (main #309, tag v0.1.12). Closes Gauzy task Ever Gauzy #645.

Why

Since #11505, the in-process Plane proxy calls this API over loopback. Gauzy therefore counted every pm.gauzy.co call against 127.0.0.1: one rate-limit bucket for public routes (login, email-check) and one sign-in-attempt bucket for all users.

0.1.12 passes on, unchanged, the headers Gauzy reads the client's address from:

  • X-Forwarded-For, or the socket address when there is none;
  • CF-Connecting-IP;
  • the signed X-Ever-Client-IP set.

Gauzy therefore resolves the same client for the proxied call as for the browser's own request: the signed address first, then CF-Connecting-IP (trusted on prod), then req.ip with the default one-hop TRUST_PROXY. A client gains nothing it couldn't get by sending the same headers to Gauzy directly. No Gauzy code changes.

Changes

  • packages/plugins/integration-plane/package.json: api and models ^0.1.11 → ^0.1.12.
  • Root package.json: models ^0.1.11 → ^0.1.12.
  • yarn.lock: the two entries move to 0.1.12, with resolved URL, sha1 and sha512 taken from the registry.
    • The runtime dependencies of both packages are identical to 0.1.11, so the dependency blocks are unchanged.
    • api 0.1.12 still asks for models ^0.1.11, so that range now shares the 0.1.12 entry.
    • The lockfile parses with @yarnpkg/lockfile (6,217 entries), and it has no localhost URLs.

Verification (plugin side)

  • 10 suites, 55 specs, including an Express end-to-end check (trust proxy = 1) that the loopback call resolves the same req.ip as the original request. The control without the headers gives 127.0.0.1.
  • The built package was loaded in Node before publishing.
  • Both versions are on npm.

🤖 Generated with Claude Code

Summary by cubic

Bumps @ever-gauzy/plugin-integration-plane-api and -models to 0.1.12 so the in-process Plane proxy forwards the client's address headers. Since #11505 every proxied call was counted against 127.0.0.1, giving all users one shared rate-limit and sign-in-attempt bucket; now the proxy passes X-Forwarded-For, CF-Connecting-IP, and the signed X-Ever-Client-IP unchanged, so Gauzy resolves the same client as for the browser's direct request. This is a version-only dependency bump with no Gauzy code changes.