chore(deps): bump express-rate-limit and ip-address

[claude]

✅ Checklist

• I have followed every step in the contributing guide
• The PR title follows the convention.
• I ran and tested the code works

---

Before: ip-address resolved twice in pnpm-lock.yaml — 8.1.0 under @jsonhero/json-infer-types, and 10.0.1 under express-rate-limit.

After: a single ip-address@10.2.0 entry, shared by both chains.

How: express-rate-limit@8.2.1 pinned ip-address to an exact version, so the parent itself had to move — 8.5.1 onwards declares a range instead, and @modelcontextprotocol/sdk already allows ^8.2.1, so scoping that parent to ^8.6.0 lets ip-address resolve on its own. @jsonhero/json-infer-types caps ip-address at ^8.1.0 and is already at its latest published release, so that chain gets a scoped override instead of a parent bump. jsbn and sprintf-js drop out of the tree as a side effect.

Both overrides are parent-scoped, so the cli-v3 chain is deliberately untouched: it resolves @modelcontextprotocol/sdk 1.25.2, which declares express-rate-limit ^7.5.0 and pulls in no ip-address at all.

pnpm-lock.yaml regenerated. package.json and pnpm-lock.yaml are the only two files changed.

Nothing in the repo imports ip-address or express-rate-limit directly. Both chains are transitive under apps/webapp — @jsonhero/schema-infer (used by TestTaskPresenter.server.ts) and @vercel/sdk — so no published @trigger.dev/* package is affected.

---

Testing

• pnpm install --lockfile-only regenerates cleanly, and pnpm install --frozen-lockfile --lockfile-only passes, so the lockfile matches the manifests.
• Package churn is limited to the intended set: express-rate-limit 8.2.1 to 8.6.0, ip-address 8.1.0 and 10.0.1 collapsing to 10.2.0, and jsbn / sprintf-js removed. No other resolution moved.
• @jsonhero/json-infer-types only calls new Address4() / new Address6() inside a try/catch to classify strings. Ran that exact logic against both 8.1.0 and 10.2.0 over 27 inputs (v4, v6, zone IDs, CIDR, IPv4-mapped, malformed, empty, non-strings): identical results in all 27. Both are still CJS named exports in 10.2.0, with the same engines floor.
• Drove the real inferSchema() path from @jsonhero/schema-infer with ip-address forced to 10.2.0; it still detects ipv4 and ipv6 formats correctly.
• express-rate-limit 8.6.0 keeps the same express peer range (>= 4.11) and the same node floor as 8.2.1. Its new debug dependency resolves to a version already present in the tree.
• oxfmt --check passes on the modified package.json.
• Both bumped versions clear the repo's minimumReleaseAge window; the newest express-rate-limit (8.6.1) and ip-address (10.2.1+) releases do not yet, which is why this lands on 8.6.0 and 10.2.0.
• Not run here: a full monorepo install, typecheck and test suite. No TypeScript changed, and neither package leaks types into ours — ip-address is not referenced in json-infer-types' or schema-infer's declaration files — so CI should be the judge of the wider suite.

---

Changelog

Routine dependency maintenance, no behaviour change. No changeset or .server-changes/ entry: the diff touches only the root package.json and pnpm-lock.yaml, not packages/*, integrations/*, apps/webapp/ or apps/supervisor/.

[changeset-bot]

⚠️ No Changeset found

Latest commit: dec7378

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.