Summary

Fixed:

• apps/test-suite: artillery 2.0.33 → 2.0.34 fixes GHSA-px8p-9vwx-vf98

Deferred:

• GHSA-v2v4-37r5-5v8g / ip-address in apps/api: blocked | temp-ignore
  • Reason: latest geoip-country still depends on ip-address 6.x; the patched line is 10.x, a multi-major jump that is not safe to override without compatibility approval. Existing allowlist in apps/api/audit-ci.jsonc remains (expires 2026-09-23).
  • Next action: waiting on upstream; needs approval for a major-crossing compatibility investigation or package replacement
  • Tracking: create internal ticket
• GHSA-mwp4-54f8-5fhr / ip-address in apps/api: blocked | temp-ignore
  • Reason: same dependency chain and blocker as above.
  • Next action: waiting on upstream; needs approval for a major-crossing compatibility investigation or package replacement
  • Tracking: create internal ticket

Verification:

• CI-equivalent audit: passed with approved deferment

  

Summary by cubic

Updates artillery to 2.0.34 in apps/test-suite to fix GHSA-px8p-9vwx-vf98 and clear the 2026-09-04 pnpm audit failure.

Deferred

• GHSA-v2v4-37r5-5v8g and GHSA-mwp4-54f8-5fhr remain deferred in apps/api because geoip-country depends on ip-address 6.x and the patched line is 10.x.
• The allowlist in apps/api/audit-ci.jsonc stays until 2026-09-23, and a tracking ticket will be created for the upstream blocker.
• The CI-equivalent audit passes with the approved deferment.

^{Written for commit 6bf4890. Summary will update on new commits.}