Skip to content

Commit

Permalink
Upgrade Socks package to remove vulnerable ip package
Browse files Browse the repository at this point in the history
GHSA-78xj-cgh5-2h22

ip was used by socks
JoshGlazebrook/socks#93 (comment) (also
by storybook but I'm not worried about that), so we upgrade socks.
The ip package itself seems dead.
  • Loading branch information
markhepburn committed Feb 19, 2024
1 parent 3b109ab commit 30347c2
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 14 deletions.
3 changes: 2 additions & 1 deletion frontend/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -31,21 +31,22 @@
"react-sizeme": "^3.0.1",
"react-transition-group": "4.4.2",
"shadow-cljs": "2.19.9",
"socks": "2.7.3",
"vega": "^5.23.0",
"vega-embed": "^6.21.0",
"vega-lite": "^5.2.0"
},
"devDependencies": {
"@babel/core": "^7.15.8",
"@babel/plugin-proposal-nullish-coalescing-operator": "7.18.6",
"parcel": "^2.9.3",
"@storybook/addon-actions": "^6.3.12",
"@storybook/addon-essentials": "^6.3.12",
"@storybook/addon-links": "^6.3.12",
"@storybook/react": "^6.3.12",
"babel-loader": "^8.2.3",
"node-sass": "^7.0.3",
"node-sass-package-importer": "^5.3.2",
"parcel": "^2.9.3",
"sass": "^1.58.3"
},
"scripts": {
Expand Down
39 changes: 26 additions & 13 deletions frontend/yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -7651,15 +7651,18 @@ invariant@^2.2.4:
dependencies:
loose-envify "^1.0.0"

ip@^1.1.5:
version "1.1.5"
resolved "https://registry.yarnpkg.com/ip/-/ip-1.1.5.tgz#bdded70114290828c0a039e72ef25f5aaec4354a"
integrity sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=
ip-address@^9.0.5:
version "9.0.5"
resolved "https://registry.yarnpkg.com/ip-address/-/ip-address-9.0.5.tgz#117a960819b08780c3bd1f14ef3c1cc1d3f3ea5a"
integrity sha512-zHtQzGojZXTwZTHQqra+ETKd4Sn3vgi7uBmlPoXVWZqYvuKmtI0l/VZTjqGmJY9x88GGOaZ9+G9ES8hC4T4X8g==
dependencies:
jsbn "1.1.0"
sprintf-js "^1.1.3"

ip@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/ip/-/ip-2.0.0.tgz#4cf4ab182fee2314c75ede1276f8c80b479936da"
integrity sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ==
ip@^1.1.5:
version "1.1.8"
resolved "https://registry.yarnpkg.com/ip/-/ip-1.1.8.tgz#ae05948f6b075435ed3307acce04629da8cdbf48"
integrity sha512-PuExPYUiu6qMBQb4l06ecm6T6ujzhmh+MeJcW9wa89PoAz5pvd4zPgN5WJV104mb6S2T1AwNIAaB70JNrLQWhg==

ipaddr.js@1.9.1:
version "1.9.1"
Expand Down Expand Up @@ -8208,6 +8211,11 @@ js-yaml@^4.1.0:
dependencies:
argparse "^2.0.1"

jsbn@1.1.0:
version "1.1.0"
resolved "https://registry.yarnpkg.com/jsbn/-/jsbn-1.1.0.tgz#b01307cb29b618a1ed26ec79e911f803c4da0040"
integrity sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==

jsbn@~0.1.0:
version "0.1.1"
resolved "https://registry.yarnpkg.com/jsbn/-/jsbn-0.1.1.tgz#a5e654c2e5a2deb5f201d96cefbca80c0ef2f513"
Expand Down Expand Up @@ -11431,12 +11439,12 @@ socks-proxy-agent@^6.0.0:
debug "^4.3.3"
socks "^2.6.2"

socks@^2.6.2:
version "2.7.1"
resolved "https://registry.yarnpkg.com/socks/-/socks-2.7.1.tgz#d8e651247178fde79c0663043e07240196857d55"
integrity sha512-7maUZy1N7uo6+WVEX6psASxtNlKaNVMlGQKkG/63nEDdLOWNbiUMoLK7X4uYoLhQstau72mLgfEWcXcwsaHbYQ==
socks@2.7.3, socks@^2.6.2:
version "2.7.3"
resolved "https://registry.yarnpkg.com/socks/-/socks-2.7.3.tgz#7d8a75d7ce845c0a96f710917174dba0d543a785"
integrity sha512-vfuYK48HXCTFD03G/1/zkIls3Ebr2YNa4qU9gHDZdblHLiqhJrJGkY3+0Nx0JpN9qBhJbVObc1CNciT1bIZJxw==
dependencies:
ip "^2.0.0"
ip-address "^9.0.5"
smart-buffer "^4.2.0"

source-list-map@^2.0.0:
Expand Down Expand Up @@ -11533,6 +11541,11 @@ split-string@^3.0.1, split-string@^3.0.2:
dependencies:
extend-shallow "^3.0.0"

sprintf-js@^1.1.3:
version "1.1.3"
resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.1.3.tgz#4914b903a2f8b685d17fdf78a70e917e872e444a"
integrity sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==

sprintf-js@~1.0.2:
version "1.0.3"
resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.0.3.tgz#04e6926f662895354f3dd015203633b857297e2c"
Expand Down

0 comments on commit 30347c2

Please # to comment.