PR duplication is recurring — #119 and #120 both fix #118, unreviewed for 1-2 days (repeat of #102)

[dmchaledev]

Problem

Issue #102 ("PR pipeline has stalled since 2026-06-16 — 56 open PRs, heavy duplication, nothing merging") was closed as completed on 2026-07-19. Its core recommendation was:

if the automated routine that opens these PRs/issues can search existing open PRs/issues touching the same file or topic before filing a new one, it would stop re-proposing fixes that are already sitting in the queue.

Six days later, the exact pattern is recurring at small scale, which is the cheapest point to catch it before it compounds back into a large backlog:

• SSRF guard's isPrivateIPv6 doesn't recognize the NAT64 well-known prefix — private IPv4 targets can be reached via a synthesized IPv6 literal #118 ("SSRF guard's isPrivateIPv6 doesn't recognize the NAT64 well-known prefix") was filed 2026-07-23.
• PR fix(fetch): close NAT64/6to4 SSRF-guard bypass in isPrivateIPv6 #119 ("fix(fetch): close NAT64/6to4 SSRF-guard bypass in isPrivateIPv6"), opened 2026-07-24, claims to fix SSRF guard's isPrivateIPv6 doesn't recognize the NAT64 well-known prefix — private IPv4 targets can be reached via a synthesized IPv6 literal #118 with a hand-rolled ipv6ToBytes parser.
• PR fix(fetch): recognize NAT64 and 6to4 IPv6 forms in the SSRF private-IP guard #120 ("fix(fetch): recognize NAT64 and 6to4 IPv6 forms in the SSRF private-IP guard"), opened 2026-07-25 — one day later, from a different branch/session — claims to fix the same SSRF guard's isPrivateIPv6 doesn't recognize the NAT64 well-known prefix — private IPv4 targets can be reached via a synthesized IPv6 literal #118 with a different, non-identical implementation (expandIPv6).

Both PRs modify the same function (isPrivateIPv6 in src/fetch.ts) to solve the same problem in incompatible ways. Neither has been reviewed, merged, or flagged as a duplicate of the other. Left alone, this is exactly the seed of the #102 backlog: nobody is closing the loser before the next run picks a different unrelated topic and adds a third open PR to the pile.

Separately, PR #103 (dependabot typescript 5.9.3 → 7.0.2) has been open since 2026-07-13 (13 days) with no action — a second, independent signal that inbound PRs aren't being triaged on a regular cadence right now.

Why this is high-leverage right now

Catching this at 2 duplicate PRs + 1 stale dependency PR costs one triage pass. Catching it at 56 open PRs (as #102 documented) costs a multi-day cleanup effort and lets real fixes (like the SSRF hardening in that backlog) sit unmerged for weeks. The fix is cheap only if it happens now.

Proposed action

1. Pick one of fix(fetch): close NAT64/6to4 SSRF-guard bypass in isPrivateIPv6 #119/fix(fetch): recognize NAT64 and 6to4 IPv6 forms in the SSRF private-IP guard #120, merge it, close the other with duplicate_of pointing at the survivor. Skimming both: fix(fetch): recognize NAT64 and 6to4 IPv6 forms in the SSRF private-IP guard #120 explicitly notes it fails closed on unparseable addresses and lists a slightly broader test matrix (public-IPv6 non-regression case, non-dotted IPv4-mapped rejection); fix(fetch): close NAT64/6to4 SSRF-guard bypass in isPrivateIPv6 #119 covers the 64:ff9b::101 zero-compression edge case explicitly in its own tests. Whichever is picked, port over any test case the other has that it's missing before merging.
2. Merge or close chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #103 (dependabot) — it's 13 days stale; either it's safe to fast-forward or there's a reason it's being held that should be recorded in a comment.
3. Recurrence prevention, restating PR pipeline has stalled since 2026-06-16 — 56 open PRs, heavy duplication, nothing merging #102's ask since it evidently didn't stick: before an automated session opens a new PR, it should check list_pull_requests/search_issues for existing open PRs/issues referencing the same file or issue number, and either extend the existing PR or skip filing a new one.

Scope

No source changes. This is a repo-hygiene/triage issue covering PRs #119, #120, #103.