From a0e6897768232c2ed0b8478eb970fd7e377d2ac4 Mon Sep 17 00:00:00 2001
From: Aaron Sachs <898627+asachs01@users.noreply.github.com>
Date: Thu, 6 Aug 2026 16:23:41 +0000
Subject: [PATCH] fix(deps): ignore unreachable ip-address advisory in
 dependabot config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dependabot's daily Security job has failed identically since at least
2026-08-04 (security_update_not_possible: latest-resolvable-version
10.2.0, lowest-non-vulnerable-version 10.3.1). Same root cause as
node-ninjaone#66: ip-address is nested 3 deep via @semantic-release/npm
-> npm (bundled) -> socks -> ip-address@10.2.0, and npm bundles its
entire dependency tree at publish time, so it's unreachable from this
repo's own dependency graph (verified empirically on node-ninjaone,
not re-tested per-repo since the chain is byte-identical across this
shared template).

Ignoring it in dependabot.yml (dated comment explaining why + how to
revisit) so the doomed daily retry stops failing CI. The underlying
GHSA alert stays open/visible on the repo's Security tab — this only
stops the unreachable PR-open attempt, not the vulnerability tracking.
---
 .github/dependabot.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f382e21..2ea7cba 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -29,6 +29,29 @@ updates:
         update-types: ["minor", "patch"]
     # Production MAJORS are intentionally NOT grouped → individual PRs, held for
     # human review (never auto-merged).
+    ignore:
+      # ip-address (GHSA, affects <=10.3.0) is unreachable, not unaddressed.
+      # It's nested 3 deep: @semantic-release/npm -> npm (bundled) -> socks ->
+      # ip-address@10.2.0. `npm` ships with bundleDependencies covering its
+      # entire tree, so it's vendored/pre-resolved at publish time — verified
+      # empirically 2026-08-06 (on node-ninjaone) that a package.json
+      # `overrides` pin has ZERO effect on this path
+      # (node_modules/npm/node_modules/ip-address stayed at 10.2.0 after npm
+      # install with the override in place). No amount of top-level
+      # dependency management in THIS repo can reach it; only a new `npm`
+      # release bundling a patched socks/ip-address closes this. Without this
+      # ignore, Dependabot's daily Security job retries and fails
+      # (security_update_not_possible) every day, which is worse than silent —
+      # a permanently-red scheduled job trains everyone to stop looking at it,
+      # which could mask an unrelated, actually-fixable advisory later.
+      # The underlying GHSA alert stays open/visible on the repo's Security >
+      # Dependabot alerts tab regardless of this ignore — this only stops the
+      # doomed daily PR-open attempt, it does not dismiss the vulnerability.
+      # Revisit: no automatic re-check exists for an `ignore` rule — periodically
+      # confirm whether a newer npm (check `npm view npm dependencies` chain,
+      # or just remove this ignore and see if Dependabot succeeds) bundles a
+      # fixed ip-address, then remove this block.
+      - dependency-name: "ip-address"
 
   - package-ecosystem: "github-actions"
     directory: "/"