Bump ip-address and socks

[dependabot]

Bumps ip-address and socks. These dependencies needed to be updated together.
Updates ip-address from 9.0.5 to 10.2.0

Commits

• See full diff in compare view

Updates socks from 2.8.3 to 2.8.9

Commits

• c191a5c 2.8.9
• 1eb8ea7 2.8.8
• c8f3d34 upgrade ip-address (#116)
• 83435e0 2.8.7
• 4ffb89d Bump ip-address from 9.0.5 to 10.0.1 (#113)
• 80cbeb9 2.8.6
• a753596 fix: prevent RangeError by validating domain length in socks5 client (#111)
• 93818fc 2.8.5
• f047ee4 2.8.4
• 8146521 Corrected the UDP Relay section in the README. (#109)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Low risk lockfile-only dependency bumps, but they touch SOCKS/IP parsing libraries so proxy/network-related tooling could behave differently if relied on in dev workflows.

Overview
Updates package-lock.json to bump ip-address from 9.0.5 to 10.2.0 and socks from 2.8.3 to 2.8.9 (with socks now depending on ip-address ^10.1.1).

This removes transitive deps (jsbn, sprintf-js) that were previously pulled in via ip-address, and adds license metadata for the updated packages.

^{Reviewed by Cursor Bugbot for commit bd5b1c3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🚨 Supply-chain cooldown check failed

1 package(s) below the 7-day cooldown threshold.

This guards against supply-chain attacks (e.g. Mini Shai-Hulud) where a malicious version is published and exfiltrates within hours. Wait until the version ages out, pin to an older known-good version, or add the security/cooldown-override label after manual review of the package's publish history.

Ecosystem	Package	Version	Published	Age
npm	socks	2.8.9	2026-05-08T19:49:47	4.2 days

How to unblock

1. Wait it out. Most safe choice. The package will pass the check in 7 days minus its current age.
2. Pin to an older version. Update your spec or lockfile to a version published > 7 days ago.
3. Override. Add the security/cooldown-override label after manually verifying the package's npm/PyPI history, maintainer, and changelog. The override is logged in PR history; reviewers can audit.

Generated by supply-chain-guard.