[dependabot]

Bumps ip-address from 10.7.2 to 10.7.5.

Release notes

Sourced from ip-address's releases.

v10.7.5

Full Changelog: beaugunderson/ip-address@v10.7.4...v10.7.5

v10.7.4

Full Changelog: beaugunderson/ip-address@v10.7.3...v10.7.4

v10.7.3

What's Changed

• Reject an in-addr.arpa name longer than 32 characters before splitting it by @​beaugunderson in beaugunderson/ip-address#228

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

Commits

• db0dbda 10.7.5
• 82a72d7 Read Teredo flags from the bits inspectTeredo names
• 172afdd Update mocha to 12 and patch vulnerable transitive dev dependencies
• 8c0ec94 Test that every parser rejects fullwidth and other non-ASCII digits
• 651c1dd 10.7.4
• ec80fcd Find an IPv6 zone by index so a rejected zone costs one pass
• e22eb4a Check generated docs without writing or hiding partial staging
• c7f838e 10.7.3
• 09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[maxigimenez]

Security triage: Tier B — ready, but wants a human decision

What and why

package	from	to	severity	via
ip-address	10.7.2	10.7.5	moderate	express-rate-limit (runtime), socks (dev)

• GHSA-rxp7-6hxx-x8q5 — CWE-1333, affected <=10.7.3
• No Vanta finding for this one. It came from npm audit in mcp-server, so it has no remediateByDate and no SLA clock.

Advisory impact, quoted: "Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process."

Exposure

Runtime. ip-address resolves under two parents in mcp-server/package-lock.json:

• express-rate-limit → dev: false
• socks → dev: true

A package that resolves under both scopes counts as runtime. mcp-server publishes @currents/mcp, so this reaches a shipped artifact.

The fix

Mechanism: dependabot-pr. The diff is one lockfile stanza, patch-level within 10.7.x — no manifest edit, no new resolution.

Breaking-change check

The ip-address 10.7.3 → 10.7.5 range carries the zone-identifier fix and no breaking-change, removal or deprecation section.

Verification

Not run locally this run — this PR does not qualify for auto-merge regardless of the result (see below), so the CI evidence stands on its own:

check	conclusion
Test (Node 20.x)	success
Test (Node 22.x)	success
Test (Node 24.x)	success

CI coverage

Triggers test.yml on pull_request → main, with no paths filter, so the lockfile-only diff does run it. Does not trigger publish.yaml, release.yaml or promote.yaml (workflow_dispatch), linear-release.yaml or post-release.yaml (push/close on main), or sync-from-monorepo.yaml (scheduled).

Why this does not auto-merge

Runtime dependencies never auto-merge, transitive or not. ip-address reaches the published @currents/mcp package, which puts it outside the development-scope set that may merge unattended.

What a human should still check

1. Whether express-rate-limit's use of Address6 ever parses attacker-supplied strings — if it does not, the practical exposure is lower than the advisory's.
2. This needs a release to reach installed clients. Worth batching with the next @currents/mcp publish rather than releasing on its own.

Needs release

@currents/mcp — the fix reaches clients only once published.

---

Generated by Claude Code