[aeronauty-flexcompute]

Patch four vulnerable transitive dependencies within their existing parent ranges: UI probe-image-size7.2.3→7.4.0 (#173), docs websocket-driver0.7.4→0.7.5 (#94), shell-quote1.8.3→1.8.4 (#64) and proxy-addr2.0.7→2.0.8 (#178). Keep other dependency versions unchanged. UI/Python/top changelog and UI lock roots remain synchronized at the pending1.1.9 release.

PR impact

Head ff578e4; main/base/merge-base cf303d7. Full incremental scope:6files,+35/-16. Today's addition versus154713f is3files,+16/-4: one transitive lock entry, changelog text/date and a developer documentation page. Small review size does not establish small reach; dependency code executes below existing consumers. Advisory retained5000 lexical candidate lines and is not a complete runtime dependency graph.

• Existing PlotBuilder/Distribution/DataExplorer→react-plotly→full Plotly→image trace calc→getImageSize→probe-image-size/sync. Parser reach requires image input; inspected plot-builder controls create scatter/bar. Attacker-controlled image reach is not demonstrated. Existing UI consumer.
• Docusaurus→webpack-dev-server→sockjs/faye-websocket→websocket-driver requires a running development server accepting WebSocket traffic. Its launch-editor consumer uses shell-quote.parse; the reported vulnerable quote(op) route was not found there. Existing parser/protocol checks remain relevant to the unchanged prior patch.
• Docusaurus→webpack-dev-server5.2.3→Express→proxy-addr lock→Express req.ip/req.ips. IP spoofing activates with configured IPv6 trust subnets that incorrectly match arbitrary IPv4 clients, plus a consumer relying on the resolved IP. Installed Express defaults trust proxy=false; inspected webpack-dev-server/repository configuration did not enable the problematic subnets. Package spoofing reproduced; an exploitable Flexfoil configuration was not demonstrated. Parent ~2.0.7 range and forwarded/ipaddr.js pins remain unchanged.
• The existing docs workflow builds static files and copies them to S3/CloudFront; the dependency is development/build tooling, not evidence that published static docs run Express. Exposure documentation. No solver source or formulas change.
• Version/changelog fields reach existing UI notices and future Python distribution metadata. Other open PRs also change versions; reconcile metadata/checks/impact after any main change.

Validation and limits

• Fresh docs npm ci --ignore-scripts succeeds with the exact pinned registry integrity; only proxy-addr's package entry changed relative to154713f. Parent ranges and all other dependency entries compare equal.
• Installed-package regression fails on2.0.7 and passes on2.0.8: untrusted IPv4 spoofed X-Forwarded-For rejected for ::ffff:10.0.0.0/8 and ::/1; ordinary10.0.0.0/8 and correctly mapped/104 preserve internal proxies and direct clients.
• Current docs production build passes with the new page and no broken links. git diff --check passes. Prior exact UI/protocol/parser dependency checks and UI production build passed at154713f; no UI dependency changed in this follow-up.
• Current-head Rust/Python pass in run39012275495; Bugbot pending and eligible approving review still missing. No manual deployment, release or main merge. End-to-end malicious dev-server exploitation and arbitrary deployment trust settings remain unchecked. MapLibre#156 and joi#177 remain unresolved; severity alone does not establish application exploitability.

Changelog, Versions & Docs

• What's New includes each user-visible security update
• UI package, top changelog and UI lock roots agree at1.1.9
• Python distribution version already bumped to1.1.9
• Affected development-server exposure/configuration documentation added and docs built
• No new owned runtime primitive or solver/API behavior; no deployment requested