From 26aba9562a0ea2111ea9cb450665c87e05569645 Mon Sep 17 00:00:00 2001 From: idapixl Date: Mon, 5 Oct 2026 23:09:12 -0700 Subject: [PATCH] fix(deps): bump proxy-addr 2.0.8 and source-map-js 1.2.2 for new advisories proxy-addr 2.0.7 (critical, GHSA-jqcg-44mw-7w3h, IPv4-mapped IPv6 trust spoofing) is runtime via MCP SDK -> express; source-map-js 1.2.1 (high, GHSA-68fv-2mgg-jv7q) is dev via vitest -> vite -> postcss. Both advisories landed today and turn the CI audit gate red on every PR. Lockfile entries hand-edited (npm 11 strips libc fields on --package-lock-only); integrity taken from the registry. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3775b07..8d793d7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4161,9 +4161,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -4536,9 +4536,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "dev": true, "license": "BSD-3-Clause", "peer": true,