From 15a76d0acd527f9299fe96cec6d19a6aea79216b Mon Sep 17 00:00:00 2001
From: Graeme Foster <80714+GraemeF@users.noreply.github.com>
Date: Tue, 4 Aug 2026 12:45:57 +0100
Subject: [PATCH] express-rate-limit's range already admits the fix, so only
 the lock pin moves (comms-oqwt)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ip-address 10.2.0 is vulnerable to GHSA-mwp4-54f8-5fhr (HIGH). It reaches
us transitively — @modelcontextprotocol/sdk depends on express-rate-limit,
which declares `ip-address: ^10.2.0`. 10.3.1 already satisfies that range,
so nothing needs to be declared, widened, or overridden: the lock pin was
the only thing holding the tree on the vulnerable version.

The lock entry is edited in place rather than refreshed by resolution.
`bun update ip-address` promotes it to a direct dependency of the root
package and leaves express-rate-limit's copy on 10.2.0 — a manifest change
that does not fix the vulnerable copy. Dropping the entry and re-resolving
does fix it, but carries nine unrelated packages with it, including a
@parcel/watcher major that drops the win32-ia32 binary.

bunfig.toml's minimumReleaseAge does not bite here: 10.3.1 was published
2026-07-25, so it is outside the seven-day window.
---
 bun.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bun.lock b/bun.lock
index 380868c..9933832 100644
--- a/bun.lock
+++ b/bun.lock
@@ -287,7 +287,7 @@
 
     "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
 
-    "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="],
+    "ip-address": ["ip-address@10.3.1", "", {}, "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g=="],
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],