fix: resolve npm audit findings and vite config warning

package.json

@@ -84,6 +84,7 @@
     "url": "git+https://github.com/CopilotKit/OpenDots.git"
   },
   "overrides": {
-    "undici": "^6.29.0"
+    "undici": "^6.29.0",
+    "katex": "^0.19.0"
   }
 }

src/browser/security.ts

@@ -3,7 +3,7 @@ import { isIP } from 'node:net';
 export function isPublicAddress(address: string): boolean {
   const ip = address.toLowerCase().replace(/^\[|\]$/g, '');
   if (isIP(ip) === 4) {
-    const [a, b] = ip.split('.').map(Number);
+    const [a, b, c] = ip.split('.').map(Number);
     return !(
       a === 0 ||
       a === 10 ||
@@ -12,9 +12,11 @@ export function isPublicAddress(address: string): boolean {
       (a === 100 && b >= 64 && b <= 127) ||
       (a === 169 && b === 254) ||
       (a === 172 && b >= 16 && b <= 31) ||
-      (a === 192 && (b === 168 || b === 0 || b === 2)) ||
-      (a === 198 && (b === 18 || b === 19 || b === 51)) ||
-      (a === 203 && b === 0)
+      (a === 192 && b === 168) ||
+      (a === 192 && b === 0 && (c === 0 || c === 2)) ||
+      (a === 198 && (b === 18 || b === 19)) ||
+      (a === 198 && b === 51 && c === 100) ||
+      (a === 203 && b === 0 && c === 113)
     );
   }
   if (isIP(ip) === 6) {

tests/security.test.ts

@@ -18,12 +18,29 @@ describe('browser network boundaries', () => {
     '3fff:0fff::1',
     '::ffff:127.0.0.1',
     '224.0.0.1',
+    '192.0.0.1',
+    '192.0.2.1',
+    '198.18.0.1',
+    '198.19.255.255',
+    '198.51.100.7',
+    '203.0.113.9',
   ])('rejects private or special address %s', (address) =>
     expect(isPublicAddress(address)).toBe(false),
   );
-  it.each(['8.8.8.8', '1.1.1.1', '2606:4700:4700::1111'])(
-    'accepts public address %s',
-    (address) => expect(isPublicAddress(address)).toBe(true),
+  it.each([
+    '8.8.8.8',
+    '1.1.1.1',
+    '2606:4700:4700::1111',
+    // Near, but outside, the documentation/benchmark ranges (not whole /16s).
+    '192.0.1.1',
+    '192.0.3.1',
+    '198.51.99.1',
+    '198.51.101.1',
+    '203.0.112.1',
+    '203.0.114.1',
+    '203.0.200.1',
+  ])('accepts public address %s', (address) =>
+    expect(isPublicAddress(address)).toBe(true),
   );
   it('rejects non-http URLs and embedded credentials', async () => {
     await expect(validateUrl('file:///etc/passwd')).rejects.toThrow();

tests/telemetry.test.ts

@@ -1,7 +1,12 @@
 import { execFile } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
 import { promisify } from 'node:util';
-import { expect, it } from 'vitest';
+import { expect, it, vi } from 'vitest';
+
+// Each probe boots a fresh Node process that imports the whole server (about 2s
+// alone, much slower under load or coverage). Vitest's 5s default is shorter
+// than the 15s child-process timeout below, which made these tests flaky.
+vi.setConfig({ testTimeout: 30_000 });
 
 const run = promisify(execFile);
 const platformUrl = new URL('../src/server/platform.ts', import.meta.url).href;

tsconfig.json

@@ -7,6 +7,7 @@
     "jsx": "react-jsx",
     "strict": true,
     "noEmit": true,
+    "allowImportingTsExtensions": true,
     "skipLibCheck": true,
     "esModuleInterop": true,
     "types": ["node", "vite/client"]

tsconfig.server.json

@@ -2,6 +2,7 @@
   "extends": "./tsconfig.json",
   "compilerOptions": {
     "noEmit": false,
+    "allowImportingTsExtensions": false,
     "outDir": "dist/server",
     "rootDir": "src",
     "module": "NodeNext",

vite.config.ts

@@ -1,6 +1,6 @@
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
-import { darkTheme } from './src/build/dark-theme';
+import { darkTheme } from './src/build/dark-theme.ts';
 export default defineConfig({
   plugins: [react()],
   css: { postcss: { plugins: [darkTheme()] } },