[mldangelo-oai]

Summary

Update ip-address from 10.7.2 to 10.7.4 in the triage evals. This fixes quadratic processing of malformed IPv6 zone identifiers. Upstream advisory

Changes

• Remove the old socks override. Both socks and express-rate-limit accept 10.7.4 in their published dependency ranges.
• Regenerate the eval lockfile with pnpm 11.25.0. Both paths resolve to 10.7.4, the only package version that changed.

Testing

• The frozen eval install, SDK eval build, and MCP native build passed. Verified that both installed consumers load 10.7.4 and accept a valid IPv6 zone identifier.
• node --run test:deterministic passed after the SDK build completed. Its final 16 runner and provider checks all passed. An earlier, overlapping rebuild removed a compiled SDK module during the first test run.
• Reproduced the upstream slowdown with the published packages. Rejecting the same malformed input took 8.26 seconds on 10.7.2 and under a millisecond on 10.7.4.
• Compared pnpm audit --prod --json on the base and PR lockfiles. Both audited 759 dependencies. The advisory count fell from eight to seven, and the ip-address advisory was the only difference. The audit still exits 1 for the remaining advisories.

Risk and rollout

The change applies to the triage eval installation. npm published 10.7.4 on October 11, and the seven-day cooldown ended on October 18. The lockfile integrity matches the published tarball. npm release metadata

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T13:19:34.202179Z	47b5bc3	PR opened
🔒 Security Review	✅ Completed 2026-10-26T13:21:31.014837Z	47b5bc3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for updating the eval dependency and removing the obsolete override. No blocking findings in this owner-level merge-safety review of 47b5bc3. Both consumers accept and resolve 10.7.4; the lockfile changes only this package, and the seven-day cooldown has elapsed.

Frozen installation, benign IPv4/IPv6/zone handling through both consumers, runtime checks and all seven runner tests passed. Base/head production audits confirm that the ip-address advisory is the only removed finding; seven existing advisories remain, so audit still exits 1. I also inspected the passing deterministic-eval CI log for the merge of this exact head and base. Full eval contracts were verified in CI, not rerun locally.