diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d6f269..5c435d2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### 🔒 Security
 
 - **Coloris (color picker) is now pinned to a fixed version with Subresource Integrity**: The dashboard loaded Coloris from jsDelivr via `@latest`, an unpinned, mutable reference with no integrity check. It's now pinned to `v0.25.0` with SRI hashes on both the script and stylesheet, so the CDN can't silently serve different content than what was reviewed.
-- **Dependencies updated to clear all known advisories**: `npm audit` reported 8 vulnerabilities (2 high, 6 moderate), including prototype pollution in `joi` and request smuggling and CRLF injection in `undici` (pulled in by discord.js). All of them were already fixed in versions the existing version ranges allow, so only the lockfile was stale. Notable bumps: discord.js 14.26.2 to 14.27.0, undici 6.27.0 to 6.29.0, joi 18.2.1 to 18.2.9, express 4.22.2 to 4.22.3. No configuration change is needed.
+- **Dependencies updated to clear all known advisories**: `npm audit` reported 8 vulnerabilities (2 high, 6 moderate), including prototype pollution in `joi` and request smuggling and CRLF injection in `undici` (pulled in by discord.js). All of them were already fixed in versions the existing version ranges allow, so only the lockfile was stale. Notable bumps: discord.js 14.26.2 to 14.27.0, undici 6.27.0 to 6.29.0, joi 18.2.1 to 18.2.9, express 4.22.2 to 4.22.3. Two later advisories are covered as well: a critical IP-spoofing issue in `proxy-addr` (used by Express to resolve client IPs behind a proxy) and several high-severity issues in `axios`, including redirect-based SSRF and header injection. Bumps: proxy-addr 2.0.7 to 2.0.8, axios 1.19.0 to 1.20.0. No configuration change is needed.
 
 ---
 
diff --git a/package-lock.json b/package-lock.json
index dfd9620..f2f4323 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -372,9 +372,9 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.19.0.tgz",
-      "integrity": "sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==",
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz",
+      "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.16.0",
@@ -1461,9 +1461,9 @@
       "license": "MIT"
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -1471,6 +1471,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/proxy-from-env": {