From 4adf35e80ec6aa15fc8e8857ebfdd321eed3f94d Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 10:40:29 +0000 Subject: [PATCH] chore(deps): bump express-rate-limit and ip-address Scope @modelcontextprotocol/sdk (>=1.26.0) to express-rate-limit ^8.6.0 and @jsonhero/json-infer-types to ip-address ^10.2.0, so both transitive ip-address resolutions land on 10.2.0 instead of 8.1.0 and 10.0.1. express-rate-limit 8.2.1 pinned ip-address to an exact version; 8.5.1 onwards declares a range instead, so moving the parent lets ip-address resolve on its own. json-infer-types caps ip-address at ^8.1.0 and is already at its latest release, so that chain needs a scoped override. The cli-v3 chain is untouched: it resolves @modelcontextprotocol/sdk 1.25.2, which declares express-rate-limit ^7.5.0 and pulls no ip-address at all. Regenerated pnpm-lock.yaml. Nothing in the repo imports either package directly; both chains are transitive under apps/webapp. --- package.json | 4 +++- pnpm-lock.yaml | 42 ++++++++++++++---------------------------- 2 files changed, 17 insertions(+), 29 deletions(-) diff --git a/package.json b/package.json index 3b00102ac8..f598705620 100644 --- a/package.json +++ b/package.json @@ -139,7 +139,9 @@ "tmp@<0.2.7": "0.2.7", "brace-expansion@<1.1.13": "1.1.13", "brace-expansion@>=2 <2.0.3": "2.0.3", - "brace-expansion@>=5 <5.0.6": "5.0.6" + "brace-expansion@>=5 <5.0.6": "5.0.6", + "@jsonhero/json-infer-types>ip-address": "^10.2.0", + "@modelcontextprotocol/sdk@>=1.26.0>express-rate-limit": "^8.6.0" }, "onlyBuiltDependencies": [ "@depot/cli", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b09dc718a6..e49d5239ae 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -51,6 +51,8 @@ overrides: brace-expansion@<1.1.13: 1.1.13 brace-expansion@>=2 <2.0.3: 2.0.3 brace-expansion@>=5 <5.0.6: 5.0.6 + '@jsonhero/json-infer-types>ip-address': ^10.2.0 + '@modelcontextprotocol/sdk@>=1.26.0>express-rate-limit': ^8.6.0 patchedDependencies: '@changesets/assemble-release-plan@5.2.4': @@ -10300,8 +10302,8 @@ packages: peerDependencies: express: ^4.11 || 5 || ^5.0.0-beta.1 - express-rate-limit@8.2.1: - resolution: {integrity: sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==} + express-rate-limit@8.6.0: + resolution: {integrity: sha512-XKJXDsASUOo0LLtFwW5hCcQGH0N4WQc/Rn8/Pvoia+TJFOkkFPvrtW9lZOeeNcxQJspvOIERMwiRLsVFlhHEkA==} engines: {node: '>= 16'} peerDependencies: express: '>= 4.11' @@ -11018,12 +11020,8 @@ packages: resolution: {integrity: sha512-UxC0Yv1Y4WRJiGQxQkP0hfdL0/5/6YvdfOOClRgJ0qppSarkhneSa6UvkMkms0AkdGimSH3Ikqm+6mkMmX7vGA==} engines: {node: '>=12.22.0'} - ip-address@10.0.1: - resolution: {integrity: sha512-NWv9YLW4PoW2B7xtzaS3NCot75m6nK7Icdv0o3lfMceJVRfSoQwqD4wEH5rLwoKJwUiZ/rfpiVBhnaF0FK4HoA==} - engines: {node: '>= 12'} - - ip-address@8.1.0: - resolution: {integrity: sha512-Wz91gZKpNKoXtqvY8ScarKYwhXoK4r/b5QuT+uywe/azv0/nUCo7Bh0IRRI7F9DHR06kJNWtzMGLIbXavngbKA==} + ip-address@10.2.0: + resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -11345,9 +11343,6 @@ packages: resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} hasBin: true - jsbn@1.1.0: - resolution: {integrity: sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==} - jsep@1.4.0: resolution: {integrity: sha512-B7qPcEVE3NVkmSJbaYxvv4cHkVW7DQsZz13pUMrfS8z8Q/BuShN+gcTXrUlPiGqM2/t/EEaI030bpxMqY8gMlw==} engines: {node: '>= 10.16.0'} @@ -14198,9 +14193,6 @@ packages: sprintf-js@1.0.3: resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} - sprintf-js@1.1.2: - resolution: {integrity: sha512-VE0SOVEHCk7Qc8ulkWw3ntAzXuqf7S2lvwQaDLRnUeIEaKNQJzV6BwmLKhOqT61aGhfUMrXeaBk+oDGCzvhcug==} - sql-formatter@15.6.12: resolution: {integrity: sha512-mkpF+RG402P66VMsnQkWewTRzDBWfu9iLbOfxaW/nAKOS/2A9MheQmcU5cmX0D0At9azrorZwpvcBRNNBozACQ==} hasBin: true @@ -18717,7 +18709,7 @@ snapshots: '@jsonhero/json-infer-types@1.2.11': dependencies: - ip-address: 8.1.0 + ip-address: 10.2.0 json5: 2.2.3 jwt-decode: 3.1.2 uuid: 8.3.2 @@ -18901,7 +18893,7 @@ snapshots: eventsource: 3.0.5 eventsource-parser: 3.1.0 express: 5.2.1 - express-rate-limit: 8.2.1(express@5.2.1) + express-rate-limit: 8.6.0(express@5.2.1) hono: 4.12.25 jose: 6.1.3 json-schema-typed: 8.0.2 @@ -25374,10 +25366,13 @@ snapshots: dependencies: express: 5.0.1(supports-color@10.0.0) - express-rate-limit@8.2.1(express@5.2.1): + express-rate-limit@8.6.0(express@5.2.1): dependencies: + debug: 4.4.3(supports-color@10.0.0) express: 5.2.1 - ip-address: 10.0.1 + ip-address: 10.2.0 + transitivePeerDependencies: + - supports-color express@4.20.0: dependencies: @@ -26323,12 +26318,7 @@ snapshots: transitivePeerDependencies: - supports-color - ip-address@10.0.1: {} - - ip-address@8.1.0: - dependencies: - jsbn: 1.1.0 - sprintf-js: 1.1.2 + ip-address@10.2.0: {} ipaddr.js@1.9.1: {} @@ -26590,8 +26580,6 @@ snapshots: dependencies: argparse: 2.0.1 - jsbn@1.1.0: {} - jsep@1.4.0: {} jsesc@3.0.2: {} @@ -30111,8 +30099,6 @@ snapshots: sprintf-js@1.0.3: {} - sprintf-js@1.1.2: {} - sql-formatter@15.6.12: dependencies: argparse: 2.0.1