[WRONG BRANCH] release: 2.79.0 dependency audit fix

[lidge-jun]

Summary

release.yml's dependency audit (bun run audit:high) refused the 2.79.0 dry run (run 37474668814) on a critical advisory published after the candidate was cut: proxy-addr <2.0.8, IP spoofing via IPv4-mapped IPv6 trust subnets (GHSA-jqcg-44mw-7w3h), reached through @modelcontextprotocol/sdk > express. gui/ reports source-map-js <1.2.2 (GHSA-68fv-2mgg-jv7q, vite > postcss), which the same audit step checks next.

bun audit fix, lockfiles only, every bump inside its declared range: proxy-addr 2.0.7 → 2.0.8, fast-uri 3.1.7 → 3.1.8, ip-address 10.4.0 → 10.7.1, and in gui/ source-map-js 1.2.1 → 1.2.2. No package.json changes.

This is the same commit as the dev PR #6687, applied on top of the 2.79.0 promotion so the release can publish without pulling the 2.80.0 pre-move onto main.

Verification

• bun audit --audit-level=high reports no vulnerabilities in the root (144 packages) and gui/ (81 packages).
• tsc --noEmit exit 0; gui bun run build succeeds.
• No local tests were run, per the owner's instruction; hosted CI covers the change.

Checklist

• Targets main (maintainer release hotfix)
• Dependency change reviewed: lockfile-only, in-range patch/minor bumps from the public registry, no new packages
• No secrets or private data

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T14:28:29.904581Z	c1dc8e4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• orphan_lockfile — bun.lock changed without package.json. Revert accidental churn or obtain dependency-change-approved.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required. hygiene: orphan_lockfile.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.
• Fix orphan_lockfile — bun.lock changed without package.json. Revert accidental churn or obtain dependency-change-approved.

Its title has been prefixed with [WRONG BRANCH].
Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.