Repository navigation
chore(deps): bump ip-address to 10.7.4 (security) - #736
Merged
Merged
Conversation
Lockfile-only bump of the transitive socks dependency ip-address from 10.7.3 to 10.7.4, which fixes GHSA-rxp7-6hxx-x8q5. postcss moves from 8.5.32 to 8.5.31 because 8.5.32 is still inside the 7-day minimumReleaseAge window. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apify-service-account
added
the
t-unblocking
VojtaM39
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lockfile-only bump of
ip-addressfrom 10.7.3 to 10.7.4.ip-addressis a transitive runtime dependency throughsocks, which proxy-chain uses directly and throughsocks-proxy-agent. Its range,^10.1.1, already allows 10.7.4.package.jsonis unchanged.Why
Closes Dependabot alert #65, GHSA-rxp7-6hxx-x8q5. In
ip-addressup to 10.7.3, theAddress6constructor checks for a zone identifier with a regular expression that takes quadratic time on input of many%characters followed by a line terminator.proxy-chain is not affected, and users need no release. Every range on the path allows the patched version, so a fresh install already resolves 10.7.4 or newer. The vulnerable code can't be reached through proxy-chain either. I tested this with a
Serveron a SOCKS upstream (socks5andsocks5h) and a counter on the vulnerable regex. Six request shapes carrying the attack input, sent throughCONNECTand plainGET, ran the regex 0 times. Each request finished in 3 ms or less, while calling the vulnerable function directly with the same input took about 555 ms. The inputs are rejected while the URL is parsed or by the 255-byte host limit insocks.sockspasses a host toAddress6only afternet.isIPv6()accepts it.This bump clears the alert and keeps CI on a patched version.
How
10.7.4 is the newest release older than the 7-day
minimumReleaseAge. 10.7.5 is still inside the window until Nov 1. A plain update won't move back past 10.7.5 (pnpm#11203), so I added a temporaryoverrides: { ip-address: 10.7.4 }, ranpnpm install, removed the override and ranpnpm installagain.Risks
postcssmoves from 8.5.32 to 8.5.31 because 8.5.32 is still inside the 7-day window. chore(deps): bump vite to 8.3.5 (security) #734 and chore(deps): bump qs to 6.16.1 (security) #735 make the same change.mastertest for test, including the SOCKS suites.🤖 Generated with Claude Code