Skip to content

Conversation

fabianbormann
Copy link

What is the purpose of this pull request? (put an "X" next to item)

[ ] Documentation update
[ ] Bug fix
[ ] New feature
[X] Other, please explain:

For the past year, there has been a vulnerability in the less/not maintained node-ip package. While the vulnerability doesn't affect bittorrent-tracker directly, it still results in a 1 high severity vulnerability warning after running npm i on this project or any other project that has bittorrent-tracker as a dependency. This creates a negative impression from a customer perspective or during code audits.

What changes did you make? (Give an overview)

This repository only uses a single static function from the node-ip package, which is unmaintained but available under the MIT license. I copied this static function directly into the parse-udp module and removed the node-ip dependency entirely.

I ran the tests, which show:

1..557
# tests 557
# pass  557

# ok

Additionally, npm i now shows found 0 vulnerabilities after running the command.

Copy link

socket-security bot commented Apr 26, 2025

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

@fabianbormann
Copy link
Author

@DiegoRBaquero, are you the right person to review this PR? If not, could you please involve someone else who could take a look at it? Thanks! 😊

Copy link

github-actions bot commented Jul 3, 2025

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

@github-actions github-actions bot added the stale label Jul 3, 2025
@github-actions github-actions bot closed this Jul 10, 2025
@fabianbormann
Copy link
Author

Please re-open the PR

@subins2000
Copy link
Contributor

This should be re-opened. It's a good change, I noticed the high severity warning as well

@SilentBot1 SilentBot1 reopened this Sep 5, 2025
@SilentBot1 SilentBot1 enabled auto-merge (squash) September 5, 2025 17:51
@github-actions github-actions bot removed the stale label Sep 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants