Patch vulnerable ip-address dependency in gh-aw-node

[Copilot]

The published gh-aw-node image includes a vulnerable npm-bundled ip-address dependency. Update the image’s existing dependency overlay to install a patched version (10.3.1+).

• Dependency remediation
  • Add ip-address@^10.3.1 to the temporary npm overlay installation.
  • Copy the patched package into npm’s bundled node_modules.

npm --prefix "$tmpdir" install --no-save \
  "ip-address@^10.3.1"

cp -rf "$tmpdir/node_modules/ip-address/." \
  "$npm_modules/ip-address/"

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-node #51708

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.58 AIC · ⌖ 8.09 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Updates the gh-aw-node image to remediate GHSA-mwp4-54f8-5fhr.

Changes:

• Installs ip-address@^10.3.1 in the dependency overlay.
• Copies the patched package into npm’s bundled dependencies.

Show a summary per file

File	Description
actions/setup/js/Dockerfile.safe-outputs-mcp	Adds the patched ip-address overlay.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Reviewed PR #51719 for over-engineering. The diff is a minimal, consistent addition (4/-3 lines) that follows the exact same pattern already used for brace-expansion, tar, and undici overlay patches. Lean already. Ship.

Generated by Ponytail Reviewer for #51719

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

The patch correctly adds ip-address@^10.3.1 to address GHSA-mwp4-54f8-5fhr, following the same well-established pattern already used for brace-expansion, tar, and undici. No issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 11.8 AIC · ⌖ 7.07 AIC · ⊞ 5.4K

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs — patch is clean and follows the established overlay pattern.

📋 Key Themes & Highlights

Key Themes

• Consistent remediation pattern: change follows the exact same overlay-install-then-copy idiom already used for brace-expansion, tar, and undici.
• Comment updated: CVE advisory reference (GHSA-mwp4-54f8-5fhr) added alongside the fix — good provenance tracking.
• Potential gap: ip-address@10.x has transitive runtime deps (jsbn, sprintf-js). The cp -rf overlays only the top-level package directory. If npm's bundled node_modules does not already have those subdeps at the right version, the patched ip-address may fail to load. See inline comment.

Positive Highlights

• CVE advisory reference included in the comment block
• --no-save flag preserves offline-install discipline
• Alphabetical ordering maintained in both the comment and the cp commands

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 17 AIC · ⌖ 7.49 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[github-actions]

[/diagnosing-bugs] ip-address@10.x depends on jsbn and sprintf-js at runtime. The cp -rf overlay copies only the top-level ip-address package; if npm's bundled node_modules lacks those transitive deps (or has incompatible versions), the patched module will throw at load time.

💡 Suggested verification

After the cp, verify the transitive deps are resolvable inside the npm prefix:

&& node -e "require('ip-address')" \

If that throws, you may need to overlay jsbn and sprintf-js with the same install-and-copy pattern.

@copilot please address this.

[gh-aw-bot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address the maintainer-facing feedback below, and run the pr-finisher skill before handing this back.

Open review context (newest first):

• github-actions thread: verify require("ip-address") still resolves after the overlay, or also overlay the needed transitive dependencies (jsbn, sprintf-js) if required (Patch vulnerable ip-address dependency in gh-aw-node #51719 (comment))
• no failed checks were listed in the compact candidate snapshot

Branch refresh was requested.
Run: https://github.com/github/gh-aw/actions/runs/31380615330

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.58 AIC · ⌖ 8.09 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address the maintainer-facing feedback below, and run the pr-finisher skill before handing this b...

Addressed the open review thread. ip-address@10.x was rewritten as pure JS and has zero runtime dependencies (confirmed by inspecting its package.json — "dependencies": {}) — jsbn and sprintf-js are no longer needed. To make this self-evident and self-validating in the build, I added a node -e "require('ip-address')" smoke-test step immediately after the cp overlay (commit Add node require verification for ip-address overlay). If the overlay ever breaks resolution, the build will fail fast.