From a08aa342b2caaab907d561ac3158f7d14fae3463 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Tue, 4 Aug 2026 01:30:57 +0200 Subject: [PATCH] Pin ip-address past the leading-zero parsing advisory Address4 decoded a leading-zero octet as decimal, so `010.0.0.1` parsed as 10.0.0.1 instead of being rejected. That is precisely the alternate-notation class `isPublicUrl` was written to catch, and this copy arrives transitively under the MCP SDK's rate limiter, where nothing of ours screens the value first. The production tree resolved 10.2.0 while the dev tree already had a fixed one, so the override names the floor rather than trusting resolution. --- pnpm-lock.yaml | 9 ++------- pnpm-workspace.yaml | 5 +++++ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 53610029d..dbe7c3e86 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -12,6 +12,7 @@ overrides: picomatch@<4.0.4: ^4.0.4 body-parser@<2.3.0: ^2.3.0 fast-uri@<3.1.5: ^3.1.5 + ip-address@<10.3.1: ^10.3.1 sharp@<0.35.0: ^0.35.3 importers: @@ -4950,10 +4951,6 @@ packages: iobuffer@5.4.0: resolution: {integrity: sha512-DRebOWuqDvxunfkNJAlc3IzWIPD5xVxwUNbHr7xKB8E6aLJxIPfNX3CoMJghcFjpv6RWQsrcJbghtEwSPoJqMA==} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} - engines: {node: '>= 12'} - ip-address@10.4.0: resolution: {integrity: sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==} engines: {node: '>= 12'} @@ -11712,7 +11709,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1(supports-color@7.2.0)): dependencies: express: 5.2.1(supports-color@7.2.0) - ip-address: 10.2.0 + ip-address: 10.4.0 express-rate-limit@8.6.1(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0): dependencies: @@ -12152,8 +12149,6 @@ snapshots: iobuffer@5.4.0: {} - ip-address@10.2.0: {} - ip-address@10.4.0: {} ipaddr.js@1.9.1: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 787fdd102..15a8dafd2 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -6,6 +6,11 @@ overrides: "picomatch@<4.0.4": "^4.0.4" "body-parser@<2.3.0": "^2.3.0" "fast-uri@<3.1.5": "^3.1.5" + # Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as + # 10.0.0.1 rather than being rejected. That is the exact alt-notation class + # `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's + # rate limiter where nothing of ours screens it. + "ip-address@<10.3.1": "^10.3.1" "sharp@<0.35.0": "^0.35.3" allowBuilds: