[CSR-0] chore: Bump ip-address from 10.1.0 to 10.4.0

[dependabot]

Bumps ip-address from 10.1.0 to 10.4.0.

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

• Add GitHub Actions CI by @​beaugunderson in beaugunderson/ip-address#213
• Keep the package loadable on node 12, and enforce it by @​beaugunderson in beaugunderson/ip-address#216
• Validate the byte arrays Address6 is given by @​beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

• fbb8db2 10.4.0
• 45a2b11 Validate the byte arrays Address6 is given (#217)
• bac8810 Keep the package loadable on node 12, and enforce it (#216)
• 9b3d848 Add a security policy and a README section on security posture
• e84a7b3 Order the README API reference Address4, Address6, AddressError
• 015160b Collapse each class in the README API reference
• 34061a8 Pin checkout and setup-node to commits in the release job
• c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
• e0ef048 Replace CircleCI with GitHub Actions
• 5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Assignees

The following users could not be added as assignees: ynahmany. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[maxigimenez]

Security triage — Tier A. Ready to merge, nothing outstanding.

What and why

ip-address 10.1.0 → 10.4.0 (HIGH; transitive, via socks). Closes Dependabot alert 171 — Vanta remediateByDate 2026-09-04, 10 days from today, the nearest deadline in this repo.

Two advisories are in range:

• GHSA-mwp4-54f8-5fhr — HIGH, <=10.3.0. This is the one Vanta filed; fixedVersion 10.3.1.

  Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass.

• GHSA-v2v4-37r5-5v8g — MODERATE, <=10.1.0. XSS in Address6 HTML-emitting methods. Not filed by Vanta; 10.4.0 closes it too.

Exposure

Development only. ip-address is recorded "dev": true in package-lock.json, reached through socks (^10.0.1). No workspace declares it and no first-party source imports it, so neither Address4 parsing nor the Address6 HTML helpers are called by our code. It does not reach a published artifact — @currents/cmd, @currents/jest and @currents/node-test-reporter do not carry it.

The fix

Mechanism: lockfile refresh. socks requests ^10.0.1, which already admits 10.3.1 and 10.4.0 — no manifest edit and no override is needed, and this PR makes none. Same major throughout.

Diff scope — the 31 added lines are mostly not this PR

The stanza count looks well past the usual bar, so worth being precise: only one dependency version moves. I ran a plain npm install on main with no other change, and it reproduces 26 of the 31 added lines on its own:

lines	what	present on main?
26	"peer": true markers on @esbuild/* platform stanzas	yes — a bare npm install on main adds all 26
2	packages/cmd 1.9.9 → 1.10.0, packages/jest 1.3.1 → 1.3.2	yes — the lockfile records stale workspace versions; package.json already says 1.10.0 / 1.3.2
3	ip-address 10.1.0 → 10.4.0	no — this is the PR

So main's lockfile is drifted from what npm generates, and this PR incidentally corrects it. Worth knowing separately: the same drift will show up in the next dependency PR too.

After checking out this branch and running npm install, git status is clean — the lockfile here is exactly what npm produces, nothing hand-edited.

Breaking-change check

10.1.0 → 10.4.0, same major. Release notes for v10.4.0, plus v10.3.1, v10.3.0, v10.2.2, v10.2.1: byte-array validation for Address6, keeping the package loadable on Node 12, and CI moved from CircleCI to GitHub Actions. No breaking-change or removal section in range.

One thing a reviewer may want to glance at, flagged by Dependabot itself: 10.4.0 adds a prepare script. npm runs prepare when installing from a git ref or in the package's own directory — not for consumers installing the published tarball — so it does not execute in our installs or in CI. Calling it out because a new install script in a dependency is the kind of thing worth seeing rather than discovering later.

Verification

step	result
npm install on this branch	pass
git diff --name-only vs main	package-lock.json only
installed version	node -e "require('ip-address/package.json').version" → 10.4.0
peer-dependency warnings	none, on this branch or on main — not "unchanged", genuinely zero either way
lockfile reproducible	npm install on the branch leaves git status clean
npm audit	the ip-address entry drops out; remaining findings are unrelated and listed below
merges cleanly	merge-base is 79293ca, current main; 0 conflicts, branch is not behind

CI coverage

All checks concluded success on head 727aee4. One caveat that the green tick hides:

• unit-test.yaml → Unit Tests: success. No paths filter; does npm ci against this lockfile and runs the packages/cmd suite. Real evidence.
• lint.yml → lint: success. No paths filter; npm ci + npm run lint. Real evidence.
• types-matrix.yml → ${{ matrix.package }} Types: skipped, typecheck-status: success. The types job is gated on changed files matching packages/**. A lockfile-only diff matches nothing, so the matrix is [""], the job is skipped, and typecheck-status still exits 0 via its any_changed != 'true' branch. Type checking did not run on this diff, even though the status check is green.

That skip is fine here — the diff contains no TypeScript and ip-address has no type surface in first-party code — but it is worth knowing that this repo's type check is structurally absent from every dependency-only PR, so it can never be the thing that catches one.

Not triggered at all: publish.yaml, linear-release.yaml (release/tag events).

What a human should still check

Nothing. Tier A: same-major bump, development-only transitive dependency, no manifest change, one dependency version moves, no peer warnings, no breaking-change section in range, and the two workflows that carry real signal both installed this lockfile and passed.

Also on this branch, not this PR's problem

npm audit reports 7 further advisories in this repo that no open PR addresses; none is filed in Vanta except the js-yaml and nanoid pair. Summarised in today's triage digest — flagging here only so the remaining red audit output after merging this is not mistaken for a regression.

---

Generated by Claude Code