chore: upgrade ip-address to ^10.7.2 to address CVE-2026-101910, CVE-2026-101911, CVE-2026-101912, CVE-2026-101913

[claude]

Fixes SOU-2365
Fixes SOU-2366
Fixes SOU-2383
Fixes SOU-2384

Summary

Refreshes the yarn.lock entry for the transitive dependency ip-address from 10.4.0 to 10.7.2 (patched floor 10.7.1).

• CVE-2026-101910 / GHSA-2vr4-cq9g-pvrc: Address6.isPrivate did not recognize the NAT64 local-use range 64:ff9b:1::/48.
• CVE-2026-101913 / GHSA-rpw4-54j3-4h4q: Address6.isLinkLocal only matched fe80::/64 instead of fe80::/10.
• CVE-2026-101911 / GHSA-h3mg-xc3c-68pw: denial of service via unbounded IPv6 address parsing (fixed in 10.7.1).
• CVE-2026-101912 / GHSA-j6r3-76f7-8jcv: access control bypass via cross-family subnet comparison in isInSubnet / isHostInSubnet (fixed in 10.7.1).

The existing ranges (socks requests ^10.1.1, express-rate-limit requests ^10.2.0) already admit the patched version, so this is a lockfile-only refresh via yarn up -R ip-address. No package.json changes or resolutions overrides.

Verification

• yarn why ip-address: every instance resolves to ip-address@npm:10.7.2.
• yarn workspace @sourcebot/backend test: 309 passed.
• yarn workspace @sourcebot/web test: 1506 passed.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c9b2dae9-c886-4951-99ac-0102b3b378f1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.