[DysektAI]

Advisory chain

Pins the rate-limiter transitive ip-address dependency to exactly 10.7.4, addressing GHSA-rxp7-6hxx-x8q5 without changing the existing IPv6 /56 grouping policy.

Verification

• Oversized IPv6 zone parsing regression detects event-loop blocking on 10.7.2; 10.7.4 passes.
• Existing IPv6 limiter grouping is covered.
• Registry metadata, lifecycle-script changes, tarball integrity and upstream tag contents were vetted. Rebuilding the tagged source with TypeScript 5.5.4 produced distribution files matching the registry package byte-for-byte.
• Initial advisory-fix local CodeRabbit review: zero findings. The later hoisting finding was fixed in ed75493 and its thread resolved.
• All 13 branch tests passed with a real nested dependency layout and after a clean locked install; all current-head GitHub checks are green.
• Both the parent test and subprocess load the actual ip-address dependency selected by the limiter, not a root-level hoisted or duplicate dev-only copy. Restoring only the subprocess's bare import is detected by a negative control.

Integration

PR #38 already includes this commit together with the separate follow-redirects advisory fix. Its combined production audit has zero advisories. The base lockfile still contains the other vulnerable transitive, so do not treat this standalone branch as a complete production dependency remediation. A fresh standalone production audit still reports one high follow-redirects vulnerability.

PARKED for the coordinated merge: the current head ed75493 is contained in #38 at 464835d, where the production audit is clean. Once #38 passes its outstanding runtime/proxy/token and restart-state gate, preserve history with a merge commit so this advisory PR can merge indirectly without a partially patched default-branch intermediate.

---

Summary by cubic

Pins the ip-address transitive dependency to exactly 10.7.4 to fix GHSA-rxp7-6hxx-x8q5 without changing the existing IPv6 /56 grouping behavior.

• Adds a regression test that rejects oversized IPv6 zones without blocking, resolving ip-address from the limiter's own installation to cover nested dependencies.
• Enforces the patched version through an overrides entry in package.json.

Note: this branch alone is not a complete production remediation—the base lockfile still contains the vulnerable follow-redirects transitive. PR #38 combines both fixes.

^{Written for commit ed75493. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: d478288a-ec6b-4983-8cd3-e3ba311118bc

📥 Commits

Reviewing files that changed from the base of the PR and between 23ca4c9 and ed75493.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 2

• package.json
• test/ip-security.test.js

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}