[BUG] release npm with upgraded dependencies to address critical CVE-2023-42282

[lalexl]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm includes nested dependency socks@2.7.1 impacted by Critical vulnerability in ip@2.0.0 CVE-2023-42282
socks@2.7.3 replaces this dependency

├─┬ make-fetch-happen@13.0.0
│ ├─┬ @npmcli/agent@2.1.1
│ │ ├─┬ http-proxy-agent@7.0.0
│ │ │ ├─┬ agent-base@7.1.0
│ │ │ │ └── debug@4.3.4 deduped
│ │ │ └── debug@4.3.4 deduped
│ │ ├─┬ https-proxy-agent@7.0.1
│ │ │ ├── agent-base@7.1.0 deduped
│ │ │ └── debug@4.3.4 deduped
│ │ ├── lru-cache@10.0.1 deduped
│ │ └─┬ socks-proxy-agent@8.0.1
│ │   ├── agent-base@7.1.0 deduped
│ │   ├── debug@4.3.4 deduped
│ │   └─┬ socks@2.7.1
│ │     ├── ip@2.0.0

Expected Behavior

npm shouldn't include any npm packages with Critical vulnerabilities.

Steps To Reproduce

1. Any environment
2. Out of the box new npm install
3. Run any security scan available

Environment

• npm: 10.4.0
• Node.js:
• OS Name: RedHat ubi8

[brock-rb2t]

thanks for adding! I guess the best response is for npm to update their version of socks, and then devextreme-cli can update their version of npm. Right?

[ghost]

Issue was addressed in ip package 2.0.1, so a package-lock update / release should do the trick for now too.
indutny/node-ip@32f468f

[invariants]

Unfortunately, this is not enough because of the bundleDependencies Key, see: TooTallNate/proxy-agents#288 (comment)

[mihob]

Any news on this topic?

[nam-nguyen-clv]

Duplicated issue #7216

[pog-charlesinglese]

I'd like to request kindly for a new release of npm that isn't dependent directly/indirectly on a vulnerable version of ip module.

[ljharb]

Duplicate of #7216.

[errodrigues]

I'm sorry but how is this closed? What's the solution here?

[agforero]

@errodrigues This is closed because it's a duplicate of #7216. If you're interested in this, you should follow that thread instead.

[errodrigues]

Thank you.