[dependabot]

Bumps ip-address from 10.2.0 to 10.5.0.

Release notes

Sourced from ip-address's releases.

v10.5.0

What's Changed

• Honor the fromURL graceful-failure contract for non-IPv6 hosts by @​beaugunderson in beaugunderson/ip-address#218
• Correct the documentation where it disagreed with the library by @​beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

• Add GitHub Actions CI by @​beaugunderson in beaugunderson/ip-address#213
• Keep the package loadable on node 12, and enforce it by @​beaugunderson in beaugunderson/ip-address#216
• Validate the byte arrays Address6 is given by @​beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

• ef98e0a 10.5.0
• 9fd1110 Correct the documentation where it disagreed with the library (#219)
• d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
• fbb8db2 10.4.0
• 45a2b11 Validate the byte arrays Address6 is given (#217)
• bac8810 Keep the package loadable on node 12, and enforce it (#216)
• 9b3d848 Add a security policy and a README section on security posture
• e84a7b3 Order the README API reference Address4, Address6, AddressError
• 015160b Collapse each class in the README API reference
• 34061a8 Pin checkout and setup-node to commits in the release job
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Balanced02]

Automated bot-PR gatekeeper: not auto-merging — needs a human look.

The diff itself is clean: package-lock.json only, ip-address 10.2.0 → 10.5.0, no source, CI config, workflow, or script changes, and no packages added or removed. I checked the lockfile integrity hash against the npm registry and it matches exactly (sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==). Same version and same hash as the sibling PR in the other repo, which is a useful cross-check.

Two things tripped my hold rules, both surfaced by Dependabot itself:

1. Releaser change. The npm publisher for this version is "GitHub Actions", new for this package since 10.2.0. My reading is benign: the npm account owner is still beaugunderson (unchanged sole maintainer), the publish used npm trusted publishing via GitHub OIDC, and the 10.4.0 changelog includes "Pin checkout and setup-node to commits in the release job" plus a new security policy — that reads as the maintainer hardening their release pipeline, not a takeover.
2. New prepare lifecycle script. The package added "prepare": "git config core.hooksPath hooks || true". prepare does not run for consumers installing from the registry tarball — only on local installs in the package root and on git dependencies — and the command is inert regardless.

Both look fine to me, but "new releaser" and "new lifecycle script" are exactly the signals I'm instructed not to wave through on my own. Please eyeball and merge if you agree.

No breaking changes flagged across 10.2.0 → 10.5.0 (three minors: an IPv6 fromURL graceful-failure fix, Address6 byte-array validation, docs, CI).

🤖 This was posted by Claude

[Balanced02]

Not merging — flagging for human review. The diff itself is clean, but the upstream package added a lifecycle script between these two versions, which is an automatic stop condition for this routine.

What changed: ip-address 10.2.0 → 10.5.0 (minor, transitive — package.json untouched), package-lock.json only. No source, CI, workflow, or script changes in this repo; no packages added or removed.

What passed:

• Lockfile integrity hash matches the npm registry entry for 10.5.0 exactly; tarball resolves to registry.npmjs.org.
• Maintainer list unchanged (beaugunderson).
• Release notes for 10.3.0–10.5.0 flag no breaking changes.

Why I stopped:

1. New lifecycle script. 10.5.0 adds "prepare": "git config core.hooksPath hooks || true", which 10.2.0 did not have. In practice this should never execute for you — npm runs prepare for the local package and for git-URL dependencies, not for deps installed from a registry tarball — and it reads as maintainer-side git-hooks setup. But a newly added lifecycle script is exactly the pattern this check exists to catch, so it wants a human eye rather than my reasoning.
2. Publisher identity changed. 10.2.0 was published by beaugunderson; 10.5.0 by GitHub Actions. This is consistent with the legitimate "Add GitHub Actions CI" change in 10.4.0 and the maintainer list is unchanged — but it's a publishing-pipeline change worth confirming alongside the point above.

One behavior change to be aware of: 10.5.0 changes fromURL to honor its graceful-failure contract for non-IPv6 hosts (#218). Documented as a correction rather than a break, but worth a glance given this repo handles URLs.

My read is that this is most likely a benign release. I'm flagging rather than merging because the rule is explicit and the cost of a human confirming is a couple of minutes.

🤖 This was posted by Claude

[Balanced02]

Bumps ip-address 10.2.0 → 10.5.0, lockfile only. Transitive via puppeteer → proxy-agent → socks-proxy-agent → socks.

Tested on Node 20.9.0: npm ci clean, npm test 2/2 pass, npm ls ip-address resolves to 10.5.0. I then ran a bounded smoke crawl against a local 4-page fixture (three pages sending Last-Modified, one deliberately omitting it) on main versus main+this PR: the sitemap XML is well-formed per xmllint and byte-identical between the two apart from the fixture's port number, so <lastmod> handling is unchanged.

This branch was behind main (based on 37d51f0, main is ca1d66f), so I tested the merge result rather than just the branch — it merges cleanly and preserves the js-yaml fix from #19.

Closes Dependabot alerts #58 (HIGH, GHSA-mwp4-54f8-5fhr), #57 and #56.

Verdict: merge.

🤖 This was posted by Claude