From 4c4aef5023f190ab78353c7d9c118fd24e98e9f5 Mon Sep 17 00:00:00 2001
From: Angie Rojas <nataliart4@gmail.com>
Date: Fri, 2 Oct 2026 16:40:11 -0500
Subject: [PATCH] Chore: ip-address vulnerability fix

Add a `socks` resolution (^2.8.3) so the transitive `socks@2.8.0` is
replaced by `socks@2.8.9`, which depends on patched `ip-address@10.x`
instead of vulnerable `ip-address@9.0.5` (GHSA-mwp4-54f8-5fhr).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 package.json |  1 +
 yarn.lock    | 34 ----------------------------------
 2 files changed, 1 insertion(+), 34 deletions(-)

diff --git a/package.json b/package.json
index 89315f6..d5a09ce 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
     "examples/*"
   ],
   "resolutions": {
+    "socks": "^2.8.3",
     "tar": "7.5.22"
   },
   "scripts": {
diff --git a/yarn.lock b/yarn.lock
index 3b068dd..0f04cda 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8687,16 +8687,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ip-address@npm:^9.0.5":
-  version: 9.0.5
-  resolution: "ip-address@npm:9.0.5"
-  dependencies:
-    jsbn: "npm:1.1.0"
-    sprintf-js: "npm:^1.1.3"
-  checksum: 10/1ed81e06721af012306329b31f532b5e24e00cb537be18ddc905a84f19fe8f83a09a1699862bf3a1ec4b9dea93c55a3fa5faf8b5ea380431469df540f38b092c
-  languageName: node
-  linkType: hard
-
 "ip-regex@npm:^5.0.0":
   version: 5.0.0
   resolution: "ip-regex@npm:5.0.0"
@@ -9916,13 +9906,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jsbn@npm:1.1.0":
-  version: 1.1.0
-  resolution: "jsbn@npm:1.1.0"
-  checksum: 10/bebe7ae829bbd586ce8cbe83501dd8cb8c282c8902a8aeeed0a073a89dc37e8103b1244f3c6acd60278bcbfe12d93a3f83c9ac396868a3b3bbc3c5e5e3b648ef
-  languageName: node
-  linkType: hard
-
 "jsc-safe-url@npm:^0.2.2":
   version: 0.2.4
   resolution: "jsc-safe-url@npm:0.2.4"
@@ -14263,16 +14246,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"socks@npm:^2.7.1":
-  version: 2.8.0
-  resolution: "socks@npm:2.8.0"
-  dependencies:
-    ip-address: "npm:^9.0.5"
-    smart-buffer: "npm:^4.2.0"
-  checksum: 10/ed0224ce2c7daaa7690cb87cf53d9703ffc4e983aca221f6f5b46767b232658df49494fd86acd0bf97ada6de05248ea8ea625c2343d48155d8463fc40d4a340f
-  languageName: node
-  linkType: hard
-
 "socks@npm:^2.8.3":
   version: 2.8.9
   resolution: "socks@npm:2.8.9"
@@ -14384,13 +14357,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sprintf-js@npm:^1.1.3":
-  version: 1.1.3
-  resolution: "sprintf-js@npm:1.1.3"
-  checksum: 10/e7587128c423f7e43cc625fe2f87e6affdf5ca51c1cc468e910d8aaca46bb44a7fbcfa552f787b1d3987f7043aeb4527d1b99559e6621e01b42b3f45e5a24cbb
-  languageName: node
-  linkType: hard
-
 "sprintf-js@npm:~1.0.2":
   version: 1.0.3
   resolution: "sprintf-js@npm:1.0.3"