diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 118cdc00268..ae5ebeb0124 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -96,7 +96,7 @@ importers:
         version: rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0)
       vite-plugin-babel:
         specifier: ^1.5.1
-        version: 1.5.1(@babel/core@7.28.5)(rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0))
+        version: 1.5.1(@babel/core@7.29.0)(rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0))
       vite-plugin-static-copy:
         specifier: ^3.2.0
         version: 3.2.0(rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0))
@@ -172,8 +172,8 @@ importers:
         specifier: ^5.2.1
         version: 5.2.1
       express-rate-limit:
-        specifier: ^8.2.1
-        version: 8.2.1(express@5.2.1)
+        specifier: ^8.2.2
+        version: 8.2.2(express@5.2.1)
       express-session:
         specifier: ^1.19.0
         version: 1.19.0
@@ -2301,6 +2301,7 @@ packages:
   basic-ftp@5.0.5:
     resolution: {integrity: sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==}
     engines: {node: '>=10.0.0'}
+    deprecated: Security vulnerability fixed in 5.2.0, please upgrade
 
   bath-es5@3.0.3:
     resolution: {integrity: sha512-PdCioDToH3t84lP40kUFCKWCOCH389Dl1kbC8FGoqOwamxsmqxxnJSXdkTOsPoNHXjem4+sJ+bbNoQm5zeCqxg==}
@@ -2967,8 +2968,8 @@ packages:
     resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
     engines: {node: '>=12.0.0'}
 
-  express-rate-limit@8.2.1:
-    resolution: {integrity: sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==}
+  express-rate-limit@8.2.2:
+    resolution: {integrity: sha512-Ybv7bqtOgA914MLwaHWVFXMpMYeR1MQu/D+z2MaLYteqBsTIp9sY3AU7mGNLMJv8eLg8uQMpE20I+L2Lv49nSg==}
     engines: {node: '>= 16'}
     peerDependencies:
       express: '>= 4.11'
@@ -3333,8 +3334,8 @@ packages:
     resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
     engines: {node: '>= 0.4'}
 
-  ip-address@10.0.1:
-    resolution: {integrity: sha512-NWv9YLW4PoW2B7xtzaS3NCot75m6nK7Icdv0o3lfMceJVRfSoQwqD4wEH5rLwoKJwUiZ/rfpiVBhnaF0FK4HoA==}
+  ip-address@10.1.0:
+    resolution: {integrity: sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==}
     engines: {node: '>= 12'}
 
   ip-address@9.0.5:
@@ -7773,10 +7774,10 @@ snapshots:
 
   expect-type@1.3.0: {}
 
-  express-rate-limit@8.2.1(express@5.2.1):
+  express-rate-limit@8.2.2(express@5.2.1):
     dependencies:
       express: 5.2.1
-      ip-address: 10.0.1
+      ip-address: 10.1.0
 
   express-session@1.19.0:
     dependencies:
@@ -8235,7 +8236,7 @@ snapshots:
       hasown: 2.0.2
       side-channel: 1.1.0
 
-  ip-address@10.0.1: {}
+  ip-address@10.1.0: {}
 
   ip-address@9.0.5:
     dependencies:
@@ -9964,9 +9965,9 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.2
 
-  vite-plugin-babel@1.5.1(@babel/core@7.28.5)(rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0)):
+  vite-plugin-babel@1.5.1(@babel/core@7.29.0)(rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0)):
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.29.0
       vite: rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0)
 
   vite-plugin-static-copy@3.2.0(rolldown-vite@7.2.10(@types/node@25.2.3)(tsx@4.21.0)):
diff --git a/src/package.json b/src/package.json
index fc1e7a29c7f..21c710e3680 100644
--- a/src/package.json
+++ b/src/package.json
@@ -38,7 +38,7 @@
     "ejs": "^4.0.1",
     "esbuild": "^0.27.3",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.2.1",
+    "express-rate-limit": "^8.2.2",
     "express-session": "^1.19.0",
     "find-root": "1.1.0",
     "formidable": "^3.5.4",