[mtrezza]

Closes #622

Fixes Dependabot alert 413 (critical, GHSA-jqcg-44mw-7w3h, CVE-2026-90711). proxy-addr is a transitive development-only dependency (via the express 5.2.1 devDependency, range ^2.0.7), so the published package is not affected.

The lock file diff is limited to the proxy-addr entry. Its dependencies (forwarded 0.2.0, ipaddr.js 1.9.1) are unchanged.

Changes

• 2.0.8: Fixes IP spoofing via IPv4-mapped IPv6 trust subnets (jshttp/proxy-addr@780911d). IPv4-mapped IPv6 candidate addresses are now canonicalized to IPv4, and an IPv6 trust subnet only matches IPv4 addresses if it is an IPv4-mapped subnet with a prefix of at least 96. The remaining changes are CI, tooling and README updates (refresh CI jshttp/proxy-addr#69, chore(ci): npm-publish via reusable workflows jshttp/proxy-addr#54, Fix "arugment" typo in README jshttp/proxy-addr#61).

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement (lock file only).

Summary by CodeRabbit

• Chores
  • This update does not change visible features, functionality, or workflows. The product behaves as before, with no new controls, settings, or user-facing fixes to note. No action is needed to continue using the product.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 005b4802-f2d1-4312-907e-7fdd11c4e709

📥 Commits

Reviewing files that changed from the base of the PR and between d6f6d2a and f5e8c09.

📒 Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The lockfile updates proxy-addr from version 2.0.7 to 2.0.8. It also changes the resolved tarball URL and integrity hash, and adds Open Collective funding metadata.

Changes: proxy-addr Update

Layer / File(s)	Summary
Update proxy-addr lock entry package-lock.json	The lockfile updates proxy-addr to version 2.0.8 and changes its tarball URL and integrity hash. It adds Open Collective funding metadata.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f5e8c

The supplied context identifies no adverse behavior from this lockfile update, so no actionable merge-blocking risk remains.

Pre-merge checks: 7

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the required refactor: prefix, and its description accurately summarizes the proxy-addr version update.
Linked Issues check		Issue #622 requires proxy-addr 2.0.8 and its CVE-2026-90711 fix. The lock file updates node_modules/proxy-addr from 2.0.7 to 2.0.8. The linked issue and PR description identify 2.0.8 as containing…
Out of Scope Changes check		The changes are limited to the proxy-addr lock-file entry. The added license and funding metadata belong to that package entry. No unrelated changes are identified.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		The PR changes only the package-lock.json entry for proxy-addr, from 2.0.7 to 2.0.8. The updated entry is marked dev-only, and the root package.json lists express only as a devDependency. The supplied…
Engage In Review Feedback		No review feedback required engagement. The supplied review data reports zero actionable findings in the current review and no posted CodeRabbit review threads. Therefore, there is no feedback that th…

Full details: Linked Issues check

Explanation

Issue #622 requires proxy-addr 2.0.8 and its CVE-2026-90711 fix. The lock file updates node_modules/proxy-addr from 2.0.7 to 2.0.8. The linked issue and PR description identify 2.0.8 as containing the mapped-IPv6 trust-subnet fix. Its forwarded and ipaddr.js dependencies remain unchanged.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

The PR changes only the package-lock.json entry for proxy-addr, from 2.0.7 to 2.0.8. The updated entry is marked dev-only, and the root package.json lists express only as a devDependency. The supplied advisory context identifies 2.0.8 as the fix for the IPv4-mapped IPv6 trust-subnet issue. The diff introduces no new security-sensitive code or dependency changes that match a stated vulnerability pattern.

Full details: Engage In Review Feedback

Explanation

No review feedback required engagement. The supplied review data reports zero actionable findings in the current review and no posted CodeRabbit review threads. Therefore, there is no feedback that the user ignored or resolved without discussion.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.77%. Comparing base (d6f6d2a) to head (f5e8c09).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #623   +/-   ##
=======================================
  Coverage   97.77%   97.77%           
=======================================
  Files           2        2           
  Lines         225      225           
=======================================
  Hits          220      220           
  Misses          5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.