fix: replace ip dependency due to security bug CVE-2024-29415

modernweb-dev · Jun 26, 2024 · 39ff6ff · 39ff6ff
1 parent c4a1044
commit 39ff6ff
Show file tree

Hide file tree

Showing 11 changed files with 254 additions and 35 deletions.
diff --git a/.changeset/lemon-suns-sneeze.md b/.changeset/lemon-suns-sneeze.md
@@ -0,0 +1,8 @@
+---
+'@web/test-runner-browserstack': patch
+'@web/test-runner-saucelabs': patch
+'@web/test-runner-core': patch
+'@web/dev-server': patch
+---
+
+replace ip dependency due to security bug CVE-2024-29415
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/dev-server/package.json b/packages/dev-server/package.json
@@ -65,7 +65,7 @@
     "command-line-usage": "^7.0.1",
     "debounce": "^1.2.0",
     "deepmerge": "^4.2.2",
-    "ip": "^2.0.1",
+    "internal-ip": "^6.2.0",
     "nanocolors": "^0.2.1",
     "open": "^8.0.2",
     "portfinder": "^1.0.32"

diff --git a/packages/dev-server/src/logger/logStartMessage.ts b/packages/dev-server/src/logger/logStartMessage.ts
@@ -1,14 +1,14 @@
 import { DevServerConfig } from '../config/DevServerConfig';
 import { Logger } from '@web/dev-server-core';
-import ip from 'ip';
+import internalIp from 'internal-ip';
 import { bold, cyan, white } from 'nanocolors';
 
 const createAddress = (config: DevServerConfig, host: string, path: string) =>
   `http${config.http2 ? 's' : ''}://${host}:${config.port}${path}`;
 
 function logNetworkAddress(config: DevServerConfig, logger: Logger, openPath: string) {
   try {
-    const address = ip.address();
+    const address = internalIp.v4.sync();
     if (typeof address === 'string') {
       logger.log(`${white('Network:')}  ${cyan(createAddress(config, address, openPath))}`);
     }

diff --git a/packages/test-runner-browserstack/package.json b/packages/test-runner-browserstack/package.json
@@ -48,7 +48,7 @@
   "dependencies": {
     "@web/test-runner-webdriver": "^0.8.0",
     "browserstack-local": "^1.4.8",
-    "ip": "^2.0.1",
+    "internal-ip": "^6.2.0",
     "nanoid": "^3.1.25"
   },
   "devDependencies": {