chore: upgrade ip-address to ^10.7.2 to address CVE-2026-101910, CVE-2026-101913

[claude]

Fixes SOU-2365
Fixes SOU-2366

Summary

Refreshes the yarn.lock entry for the transitive dependency ip-address from 10.4.0 to 10.7.2 (patched floor 10.5.1).

• CVE-2026-101910 / GHSA-2vr4-cq9g-pvrc: Address6.isPrivate did not recognize the NAT64 local-use range 64:ff9b:1::/48.
• CVE-2026-101913 / GHSA-rpw4-54j3-4h4q: Address6.isLinkLocal only matched fe80::/64 instead of fe80::/10.

The existing ranges (socks requests ^10.1.1, express-rate-limit requests ^10.2.0) already admit the patched version, so this is a lockfile-only refresh via yarn up -R ip-address. No package.json changes or resolutions overrides.

Verification

• yarn why ip-address: every instance resolves to ip-address@npm:10.7.2.
• yarn workspace @sourcebot/backend test: 309 passed.
• yarn workspace @sourcebot/web test: 1506 passed.

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only transitive dependency bump with no application code changes; risk is limited to behavior of IPv6 checks inside downstream packages like rate limiting.

Overview
Bumps the transitive ip-address dependency from 10.4.0 to 10.7.2 via a yarn.lock refresh only (no package.json or resolutions changes). Existing parent ranges from socks and express-rate-limit already allow the patched version.

This addresses IPv6 classification bugs in Address6.isPrivate (NAT64 local-use 64:ff9b:1::/48) and Address6.isLinkLocal (full fe80::/10 instead of fe80::/64). The unreleased CHANGELOG entry documents the upgrade.

^{Reviewed by Cursor Bugbot for commit 09c4913. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c9b2dae9-c886-4951-99ac-0102b3b378f1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.