Skip to content

chore(deps): bump ip-address to 10.5.1+ via scoped override - #48

Merged
GSTJ merged 1 commit into
masterfrom
chore/deps-ip-address-10.5.1
Sep 30, 2026
Merged

GSTJ merged 1 commit into
masterfrom
chore/deps-ip-address-10.5.1

Conversation

@GSTJ

@GSTJ GSTJ commented Sep 30, 2026

Copy link
Copy Markdown
Owner

Summary

We bumped the dev-only ip-address dependency past the NAT64 SSRF advisory (Dependabot alert #62).

Details

  • ip-address only comes in through release-it > proxy-agent > pac-proxy-agent > socks-proxy-agent > socks, so nothing in the published package uses it.
  • No direct parent ships a fix, so pnpm-workspace.yaml gets a scoped override: ip-address@>=10.2.0 <10.5.1: ^10.5.1. Same major, and the lockfile now resolves 10.7.2 (was 10.3.1).
  • Typed as chore(deps) since it's dev-only and shouldn't cut a release.

Testing steps

No app to click through here. From a fresh clone:

pnpm install --frozen-lockfile && pnpm why ip-address && pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build

You should see a single ip-address@10.7.2 and everything passing (72 tests green locally, no errors from lint, typecheck or build).

@GSTJ
GSTJ merged commit 2ba6881 into master Sep 30, 2026
5 checks passed
@GSTJ
GSTJ deleted the chore/deps-ip-address-10.5.1 branch September 30, 2026 12:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant