chore(deps): bump ip-address from 10.7.1 to 10.7.4 by dependabot[bot] · Pull Request #3457 · ClickHouse/ClickStack

dependabot · 2026-10-23T19:25:13Z

Bumps ip-address from 10.7.1 to 10.7.4.

Release notes

v10.7.4

Full Changelog: beaugunderson/ip-address@v10.7.3...v10.7.4

v10.7.3

What's Changed

Reject an in-addr.arpa name longer than 32 characters before splitting it by @beaugunderson in beaugunderson/ip-address#228

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

Accept an arpa suffix in any case and without the root dot in fromArpa by @beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

Commits

651c1dd 10.7.4
ec80fcd Find an IPv6 zone by index so a rejected zone costs one pass
e22eb4a Check generated docs without writing or hiding partial staging
c7f838e 10.7.3
09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
974b48d 10.7.2
4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.7.1 to 10.7.4. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.7.1...v10.7.4) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.7.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

greptile-apps · 2026-10-23T19:25:18Z

PR author is in the excluded authors list.

vercel · 2026-10-23T19:25:19Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hyperdx-oss	Ready	Preview	Oct 26, 2026 11:30pm UTC
hyperdx-storybook	Ready	Preview	Oct 26, 2026 11:30pm UTC

changeset-bot · 2026-10-23T19:25:21Z

⚠️ No Changeset found

Latest commit: cafccda

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-10-23T19:25:46Z

🟢 Tier 1 — Trivial

Docs, images, lock files, a dependency bump, or an automated release. No functional code changes detected.

Why this tier:

Bot author: dependabot[bot]

Review process: Auto-merge once CI passes. No human review required.
SLA: Resolves automatically.

Stats

Production files changed: 1
Production lines changed: 2
Branch: dependabot/npm_and_yarn/ip-address-10.7.4
Author: dependabot[bot]

To override this classification, remove the review/tier-1 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

github-actions · 2026-10-23T19:26:10Z

PR Review

✅ No issues found.

github-actions · 2026-10-23T19:26:50Z

Duplicate code analysis

No new duplicate code introduced by this PR.

jscpd compared this branch against origin/main
across app, api and common-utils. Only new clones are listed; the codebase
currently holds 114 in total (1.41%).
Run yarn dupes locally to reproduce, or yarn dupes:all for the full picture.

github-actions · 2026-10-23T19:29:08Z

Deep Review

✅ No critical issues found.

This is a Dependabot patch bump of ip-address (10.7.1 → 10.7.4) touching only packages/api/package.json and yarn.lock. The package is consumed in exactly one place — packages/api/src/utils/validators.ts, the SSRF guard (isPrivateIp, validateWebhookUrl). The correctness and security reviewers independently traced the version delta against that guard and found no behavioral change: the 10.7.2/10.7.3 releases only altered fromArpa (never called in this repo), and 10.7.4 is an internal IPv6 zone-lookup change that does not affect Address4/Address6 construction, isValid, isInSubnet, to4, or any is* category predicate the guard relies on. No input that 10.7.1 classified as private is now classified as public. package.json and yarn.lock are consistent.

🔵 P3 nitpicks (1)

.changeset/ — no changeset entry accompanies this runtime-dependency bump of the published @hyperdx/api package, which the repo's AGENTS.md convention nominally governs; likely non-applicable, since the repo auto-triages Dependabot bumps as Tier-1 and merges them without changesets.
- Fix: leave as-is unless the maintainers want patch dependency bumps reflected in release notes, in which case add a .changeset/ entry.
- _{project-standards}

Reviewers (7): correctness, security, testing, maintainability, project-standards, previous-comments, learnings-researcher.

Testing gaps: None substantive — packages/api/src/utils/__tests__/validators.test.ts already asserts concrete isPrivateIp results across every IPv4/IPv6 class the guard uses (loopback, private, link-local, CGNAT, ULA, multicast, documentation, mapped/compatible). An optional cross-version golden test over known private/public inputs would make future ip-address bumps self-verifying, but existing coverage is adequate for this change.

_{No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. How to respond}

github-actions · 2026-10-23T19:34:06Z

E2E Test Results

✅ All tests passed • 459 passed • 1 skipped • 1514s

Status	Count
✅ Passed	459
❌ Failed	0
⚠️ Flaky	0
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →

wrn14897

Minor/patch dependency bump, CI green.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 23, 2026

github-actions Bot added the review/tier-1 Trivial — auto-merge candidate once CI passes label Oct 23, 2026

vercel Bot deployed to Preview – hyperdx-storybook October 23, 2026 19:28

View deployment

vercel Bot deployed to Preview – hyperdx-oss October 23, 2026 19:30

View deployment

wrn14897 approved these changes Oct 26, 2026

View reviewed changes

wrn14897 added the automerge label Oct 26, 2026

Merge branch 'main' into dependabot/npm_and_yarn/ip-address-10.7.4

cafccda

vercel Bot deployed to Preview – hyperdx-storybook October 26, 2026 23:28

View deployment

vercel Bot deployed to Preview – hyperdx-oss October 26, 2026 23:30

View deployment

kodiakhq Bot merged commit 6234d1e into main Oct 26, 2026
28 checks passed

kodiakhq Bot deleted the dependabot/npm_and_yarn/ip-address-10.7.4 branch October 26, 2026 23:35

github-actions Bot mentioned this pull request Oct 26, 2026

chore(deps): bump next from 16.3.8 to 16.4.1 #3460

Merged

Navigation Menu

Repository navigation

chore(deps): bump ip-address from 10.7.1 to 10.7.4 - #3457

chore(deps): bump ip-address from 10.7.1 to 10.7.4#3457
kodiakhq[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/ip-address-10.7.4

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

greptile-apps Bot commented Oct 23, 2026

Uh oh!

vercel Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

wrn14897 left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026

v10.7.4

v10.7.3

What's Changed

v10.7.2

What's Changed

Uh oh!

greptile-apps Bot commented Oct 23, 2026

Uh oh!

vercel Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented Oct 23, 2026

🟢 Tier 1 — Trivial

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Uh oh!

github-actions Bot commented Oct 23, 2026

Duplicate code analysis

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deep Review

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Test Results

Uh oh!

wrn14897 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 23, 2026 •

edited

Loading

changeset-bot Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading