[tkislan]

npx better-npm-audit audit (Audit - All) and --production (Audit - Production) were failing on main (6733738) with 4 new advisories across 2 packages, all published after #578 was opened.

Each package was assessed separately against the decision ladder used by earlier audit fixes (#551, #578):

1. bump a direct dependency if it is the vulnerable one;
2. lockfile-only if no override pins the package and every consumer range admits the fix;
3. delete an override that has become a stale ceiling, or bump it if it is still needed;
4. add a new override if a consumer floors a vulnerable range;
5. add an .nsprc exception only if no patched release exists.

Neither package is a direct dependency, so rung 1 does not apply.

Decisions

Package	Advisories	Sev	Remediation	Version
dompurify	GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f	crit	lockfile-only	3.4.16 → 3.4.17
ip-address	GHSA-rxp7-6hxx-x8q5	mod	bump override (propagated to sql-lsp-modules)	10.7.3 → 10.7.4

The existing .nsprc exceptions (braces, elliptic, sprintf-js) are unchanged.

Details

dompurify: lockfile-only

• The only consumer is mermaid@11.16.1, which declares dompurify: ^3.3.3. That range admits 3.4.17, the first patched version for all three advisories.
• No override pins dompurify; chore(deps): resolve dependency vulnerabilities (2026-10-06) #551 deleted the old "dompurify" key. The "mermaid": "11.16.1" override pins mermaid only.
• Not shipped. Path: @vscode/jupyter-ipywidgets8 → @jupyterlab/notebook → @jupyterlab/markedparser-extension → @jupyterlab/mermaid → mermaid → dompurify. No dist/**/*.esbuild.meta.json has a dompurify or mermaid input, nothing in src/ imports either, and the prebuilt ipywidgets8 renderer bundle copied to dist/renderers/ contains no DOMPurify.
• 3.4.16 → 3.4.17 only adds the three advisory fixes plus some hardening. Exports, entry points and dependencies are unchanged.

         "node_modules/dompurify": {
-            "version": "3.4.16",
-            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz",
-            "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
+            "version": "3.4.17",
+            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz",
+            "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==",

ip-address: bump the exact override

• Root overrides already pins "ip-address": "10.7.3", and that pin is the only thing holding the tree on the vulnerable version: socks@2.8.7 declares ^10.0.1.
• The override stays, raised rather than deleted. build/esbuild/build.ts (sqlLspOverridesToPropagate) copies it into the isolated dist/sql-lsp-modules install, which is shipped in the VSIX, and the build throws if the key is missing. This matches chore(deps): resolve dependency vulnerabilities (2026-10-06) #551, which bumped the same key from 10.4.0 to 10.7.3.
• In both trees the only consumer is sqlite3 → node-gyp → make-fetch-happen → socks-proxy-agent → socks. At runtime sqlite3 only requires bindings, so the code path is not reachable. The fix still changes shipped files.
• 10.7.3 → 10.7.4 replaces the Address6 zone-identifier regex with indexOf and keeps the same behaviour. RE_ZONE_STRING is deprecated but still exported, and dependencies and engines are unchanged.

         "yaml": "2.8.3",
-        "ip-address": "10.7.3",
+        "ip-address": "10.7.4",
         "mermaid": "11.16.1",

         "node_modules/ip-address": {
-            "version": "10.7.3",
-            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz",
-            "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==",
+            "version": "10.7.4",
+            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz",
+            "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==",

There is no other lockfile churn.

Verification

Run locally on Node 22.21.1 / npm 10.9.4 after npm ci:

• npx better-npm-audit audit and npx better-npm-audit audit --production: both exit 0 ("All good!"). Before this change, both failed on advisories 1242880–1242883.
• npm run esbuild-all: passes. dist/sql-lsp-modules/package.json overrides now carry ip-address: 10.7.4, and the installed copy there is 10.7.4.
• npm run typecheck, npm run lint (the 27 warnings that were already there, none new), npm run format and npm run check-licenses: all pass.
• npm test: 2879 passing, 0 failing, 239 pending.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CqyiyR2czV5oi4Y4bu76FS

Summary by CodeRabbit

• Chores
  • Updated an underlying package version from 10.7.3 to 10.7.4.
  • No user-facing behavior changes are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 9115f299-10ce-4a45-8547-696231036144

📥 Commits

Reviewing files that changed from the base of the PR and between 6733738 and bbd02fc.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The ip-address dependency override in package.json changes from version 10.7.3 to 10.7.4.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: jamesbhobbs

Merge Risk: ⚪ Minimal · up to bbd02

The dependency update is consistent across the override and lockfile, with no identified merge-blocking risk.

Pre-merge checks: 6

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the dependency vulnerability remediation for both dompurify and ip-address, which matches the pull request objectives.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Updates Docs		PASS: The pull request only updates dependency resolutions in package.json and package-lock.json. It does not implement a feature, so the documentation-update requirement does not apply.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38%. Comparing base (6733738) to head (bbd02fc).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #579   +/-   ##
=====================================
  Coverage     38%     38%           
=====================================
  Files        822     822           
  Lines      41098   41098           
  Branches    9044    9044           
=====================================
  Hits       15622   15622           
  Misses     23404   23404           
  Partials    2072    2072           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.