From 8498879836a5f300264d3500540d0a4d32771f72 Mon Sep 17 00:00:00 2001
From: sysnote8main <sysnote8main@gmail.com>
Date: Tue, 25 Aug 2026 22:55:31 +0900
Subject: [PATCH] =?UTF-8?q?fix:=20bots=20=E3=81=AE=E4=BE=9D=E5=AD=98?=
 =?UTF-8?q?=E3=81=AB=20js-yaml=20/=20ip-address=20=E3=81=AE=E3=82=BB?=
 =?UTF-8?q?=E3=82=AD=E3=83=A5=E3=83=AA=E3=83=86=E3=82=A3=E3=82=AA=E3=83=BC?=
 =?UTF-8?q?=E3=83=90=E3=83=BC=E3=83=A9=E3=82=A4=E3=83=89=E3=82=92=E8=BF=BD?=
 =?UTF-8?q?=E5=8A=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- ip-address >=10.3.1 (high 1件 + medium 2件: SSRF 系)
- js-yaml >=4.3.1 <5 (high: CVE-2026-59870、メジャー互換維持のため 4.x に留める)

Closes #37
---
 bots/pnpm-lock.yaml      | 18 ++++++++++--------
 bots/pnpm-workspace.yaml |  4 +++-
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/bots/pnpm-lock.yaml b/bots/pnpm-lock.yaml
index b15866f..1f544a2 100644
--- a/bots/pnpm-lock.yaml
+++ b/bots/pnpm-lock.yaml
@@ -6,6 +6,8 @@ settings:
 
 overrides:
   uuid: '>=11.1.1'
+  js-yaml: '>=4.3.1 <5'
+  ip-address: '>=10.3.1'
 
 importers:
 
@@ -663,8 +665,8 @@ packages:
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
-  ip-address@10.2.0:
-    resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==}
+  ip-address@10.5.0:
+    resolution: {integrity: sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==}
     engines: {node: '>= 12'}
 
   ipaddr.js@1.9.1:
@@ -681,8 +683,8 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@4.3.0:
-    resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
+  js-yaml@4.3.1:
+    resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
     hasBin: true
 
   json-parse-even-better-errors@2.3.1:
@@ -1557,7 +1559,7 @@ snapshots:
     dependencies:
       env-paths: 2.2.1
       import-fresh: 3.3.1
-      js-yaml: 4.3.0
+      js-yaml: 4.3.1
       parse-json: 5.2.0
     optionalDependencies:
       typescript: 5.9.3
@@ -1864,7 +1866,7 @@ snapshots:
 
   inherits@2.0.4: {}
 
-  ip-address@10.2.0: {}
+  ip-address@10.5.0: {}
 
   ipaddr.js@1.9.1: {}
 
@@ -1874,7 +1876,7 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@4.3.0:
+  js-yaml@4.3.1:
     dependencies:
       argparse: 2.0.1
 
@@ -2433,7 +2435,7 @@ snapshots:
 
   socks@2.8.9:
     dependencies:
-      ip-address: 10.2.0
+      ip-address: 10.5.0
       smart-buffer: 4.2.0
 
   source-map@0.6.1:
diff --git a/bots/pnpm-workspace.yaml b/bots/pnpm-workspace.yaml
index 5fd76e7..8063aef 100644
--- a/bots/pnpm-workspace.yaml
+++ b/bots/pnpm-workspace.yaml
@@ -1,2 +1,4 @@
 overrides:
-  uuid: ">=11.1.1"
+  uuid: '>=11.1.1'
+  js-yaml: '>=4.3.1 <5'
+  ip-address: '>=10.3.1'