Request for patched semantic-release version to address ip package vulnerability (CVE-2023-42282) about semantic-release HOT 6 CLOSED

our dependency on socks/ip comes through npm. npm bundles their dependencies, so there is nothing we can do until there is an npm release that resolves the issue. once that happens, our dependency on npm is defined as a range, so anyone can use the latest npm version as soon as it is available without any change from our team. we will likely tighten our supported range to force the update, but no one should be blocked by our change being released.

from semantic-release.

For what it's worth, the vulnerable code does not appear to be used by socks: npm/cli#7216 (comment)

It is therefore not used by npm or semantic-release. I know a lot of people just want the audit warnings to go away, and I get that, but if you're genuinely concerned that semantic-release is exploitable, I think the answer is a solid "No". (I wouldn't expect an SSRF to affect semantic-release anyway, but the vulnerable code doesn't even get executed, apparently.)

from semantic-release.

FYI - socks removed ip from 2.7.3
https://github.com/JoshGlazebrook/socks/releases/tag/2.7.3 What's the ETA for this patch? Thank you.

from semantic-release.

npm has updated their dependency here to reference ip 2.0.1 - npm/cli#7242. So, now can we expect a patch release with updated dependencies ?

from semantic-release.

npm has updated their dependency here to reference ip 2.0.1 - npm/cli#7242. So, now can we expect a patch release with updated dependencies ?

see #3202 (comment). there is nothing we can do until there is a new release of npm. even so, there is no risk other than it being reported by whatever tool you happen to be using.

from semantic-release.

It looks like npm package has now released a new version https://github.com/npm/cli/blob/latest/CHANGELOG.md

from semantic-release.