Repository navigation
fix(deps): bump ip-address to 10.7.2 (GHSA-2vr4-cq9g-pvrc, GHSA-rpw4-54j3-4h4q, CVE sweep 2026-09-29) - #261
Merged
Conversation
ip-address 10.3.1 -> 10.7.2 (GHSA-rpw4-54j3-4h4q, GHSA-2vr4-cq9g-pvrc), root lockfile, transitive via express-rate-limit ^10.2.0; only that record changed. Coherence gate: npm ci --dry-run rc=0 under npm 10.9.8 (node 22) on clean extract. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LanNguyenSi
added
review:tests-pass
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes GHSA-2vr4-cq9g-pvrc and GHSA-rpw4-54j3-4h4q (ip-address: SSRF and trust-boundary bypass, MEDIUM). The fix bumps ip-address 10.3.1 -> 10.7.2 (via grounding-mcp > @modelcontextprotocol/sdk > express-rate-limit
^10.2.0).Only the ip-address record in
package-lock.jsonchanges (3 lines). The unrelatedlibcrewrite from npm 10 was not taken.resolved/integritymatchnpm view ip-address@10.7.2, a realnpm cileaves the lock byte-identical, andnpm run check:lockfile-integritypasses.On a clean extract,
npm ci --dry-runreturns rc=0 on base and head under npm 10.8.2 and 10.9.8, andnpm audit --audit-level=moderategoes from the listed advisories on base to 0 vulnerabilities on head. Install, build, typecheck, lint and tests are green on the branch, and an independent reviewer reproduced them. Discovery came from depsight plus the Dependabot auto_dismissed cross-check and a fleet lockfile scan (CVE sweep 2026-09-29).🤖 Generated with Claude Code