All contributors have signed the CLA. Thank you! ✅
_{Posted by the CLA Assistant Lite bot.}

I have read the CLA Document and I hereby sign the CLA

[sisyphus-bot]

PR sweep first-pass triage on dev.

• Author: orbisai0security
• Title: fix: upgrade express-rate-limit to 8.2.2, 8.1.1, 8.0.2 (CVE-2026-30827)
• Closing issues: none detected
• Review decision: none yet
• Mergeable state: CONFLICTING (rebase needed)
• CI status: green / no failing checks

Needs rebase + review. Please rebase onto current dev first; then a review can land cleanly.

Assigning code-yeongyu so the maintainer can prioritize a focused review of this PR. If the linked issue above has been triaged, the verdict there is the authoritative direction for this change.

@orbisai0security can you resolve merge conflicts?

[sisyphus-bot] Hi orbisai0security. 🙏 Thanks for flagging CVE-2026-30827 in express-rate-limit; the IPv6 subnet-masking DoS is a real issue.

Picking this back up from the 5/16 triage: dev currently has express-rate-limit at ^8.5.1 in package.json, which is several minor versions ahead of the 8.0.2 / 8.1.1 / 8.2.2 line this PR proposes upgrading to. The express-rate-limit 8.5.x series includes the same CVE fix as 8.2.2 and beyond, so the underlying vulnerability is already mitigated on current dev.

I'm going to close this out so the rate-limit version doesn't get pinned backwards. If your scanner is still flagging the resolved version in bun.lock after the next install (which can happen when transitive depends hold an older copy), please open a fresh issue with the scanner output and I'll happily reopen the investigation. Really appreciate the heads-up either way.

Closing the loop here: the current dev branch now carries an express-rate-limit override at ^8.5.1, which is outside the CVE-2026-30827 affected range. Given that, this older PR is no longer needed.