Request for patched semantic-release version to address ip package vulnerability (CVE-2023-42282)

[Soumalya-Github]

Last week, CVE 2023 42282 was reported for versions up to 2.0.0 of the NPM package ip. As this package, along with its parent dependencies, is bundled with npm, we are unable to directly update them within our project. Despite attempting to upgrade to the latest semantic-release version 23.0.2 and npm version 10.4.0, the project still references the vulnerable version of the ip package.

Moreover, ip has just recently released version 2.0.1 containing the necessary fix for the vulnerability. So, are there are any plans to release a patched version of semantic-release to align with the latest secure version of the ip package ?

[JinCoreana]

FYI - socks removed ip from 2.7.3
https://github.com/JoshGlazebrook/socks/releases/tag/2.7.3 What's the ETA for this patch? Thank you.

[travi]

our dependency on socks/ip comes through npm. npm bundles their dependencies, so there is nothing we can do until there is an npm release that resolves the issue. once that happens, our dependency on npm is defined as a range, so anyone can use the latest npm version as soon as it is available without any change from our team. we will likely tighten our supported range to force the update, but no one should be blocked by our change being released.

[Trott]

For what it's worth, the vulnerable code does not appear to be used by socks: npm/cli#7216 (comment)

It is therefore not used by npm or semantic-release. I know a lot of people just want the audit warnings to go away, and I get that, but if you're genuinely concerned that semantic-release is exploitable, I think the answer is a solid "No". (I wouldn't expect an SSRF to affect semantic-release anyway, but the vulnerable code doesn't even get executed, apparently.)

[Soumalya-Github]

npm has updated their dependency here to reference ip 2.0.1 - npm/cli#7242. So, now can we expect a patch release with updated dependencies ?

[travi]

npm has updated their dependency here to reference ip 2.0.1 - npm/cli#7242. So, now can we expect a patch release with updated dependencies ?

see #3202 (comment). there is nothing we can do until there is a new release of npm. even so, there is no risk other than it being reported by whatever tool you happen to be using.

[mccooll]

It looks like npm package has now released a new version https://github.com/npm/cli/blob/latest/CHANGELOG.md