[diegosouzapw]

Summary

This PR closes six open Dependabot alerts with a targeted patch bump, separate from the 46-package production group in #17970.

Package	Before	After	Alerts	Advisories
ip-address (root overrides)	10.7.2	10.7.4	#329	GHSA-rxp7-6hxx-x8q5, quadratic zone-identifier match in Address6
dompurify (root dependency and the monaco-editor override)	3.4.16	3.4.17	#330, #331, #332	GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f

The Dockerfile overlay of npm's bundled ip-address also moves from 10.7.3 to 10.7.4, so the image scan does not reopen the same CVE. The patched version remains within socks's declared ^10.1.1 range.

The lockfile was regenerated with npm install --package-lock-only and changes only these two packages.

Validation

• Resolved versions in the lock: dompurify 3.4.17, ip-address 10.7.4.
• check:lockfile and check:deps pass. Both packages keep their existing licenses (MPL-2.0 OR Apache-2.0, MIT).
• With the new copies unpacked into the worktree's node_modules (via npm pack), these tests pass 114/114: tests/unit/security/docs-sanitization.test.ts, tests/unit/dockerfile-npm-bundled-cve-patch.test.ts, and the rate-limit and auth tests that load express-rate-limit / ip-address.
• The full build and the Docker image are left to CI.

Not covered here:

• next (fix(cli): fix postinstall native binary rebuild regression (#321) #327, Installation fails with pnpm on Linux: @swc/helpers not found + better-sqlite3 binding missing #328, fix(auth): accept INITIAL_PASSWORD when changing first password #333) is covered by Dependabot's deps: bump next from 16.3.8 to 16.4.2 #17969.
• toml (fix(ui): translate hardcoded PT-BR text in OAuthModal to English (#314) #325, feat(registry): add new models to the provider registry #326) is a dev-only transitive dependency of @omniroute/opencode-plugin, and the fix is a major bump. That is tracked separately.

⚠️ base-red inherited: #17219

[diegosouzapw]

Closing: #18066/#18067 already carry the same dompurify and ip-address bumps. The one piece they do not cover, the Dockerfile overlay of npm's bundled ip-address (10.7.3, still in the vulnerable range), moves to a separate Dockerfile-only PR.

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.