Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: replace ip dependency due to security bug CVE-2024-29415 #2752

Merged
merged 1 commit into from
Jun 26, 2024

Conversation

bashmish
Copy link
Member

@bashmish bashmish commented Jun 13, 2024

What I did

Fixes #2747

ip package is now archived on GitHub https://github.com/indutny/node-ip/
PRs with a fix won't be released
image

Copy link

changeset-bot bot commented Jun 13, 2024

🦋 Changeset detected

Latest commit: 39ff6ff

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@web/test-runner-browserstack Patch
@web/test-runner-saucelabs Patch
@web/test-runner-core Patch
@web/dev-server Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@bashmish bashmish force-pushed the fix/ip-security-bug-CVE-2024-29415 branch from 3cd4de9 to 7da3fd6 Compare June 13, 2024 15:48
@bashmish bashmish force-pushed the fix/ip-security-bug-CVE-2024-29415 branch from 7da3fd6 to 50991c8 Compare June 13, 2024 16:01
@bashmish bashmish force-pushed the fix/ip-security-bug-CVE-2024-29415 branch from 50991c8 to 137a27d Compare June 13, 2024 16:20
@mgriffin-scottlogic
Copy link

Thanks for addressing this, does anyone know how long it might take to make it into a release? I'd like to update my dependencies to avoid this security bug as well.

@bashmish bashmish force-pushed the fix/ip-security-bug-CVE-2024-29415 branch from 137a27d to aba4aa7 Compare June 26, 2024 11:41
@bashmish bashmish force-pushed the fix/ip-security-bug-CVE-2024-29415 branch from aba4aa7 to 39ff6ff Compare June 26, 2024 11:46
@bashmish bashmish merged commit 4789c29 into master Jun 26, 2024
6 of 7 checks passed
@bashmish bashmish deleted the fix/ip-security-bug-CVE-2024-29415 branch June 26, 2024 11:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[dev-server] CVE-2024-29415: "ip SSRF improper categorization in isPublic"
3 participants