Replace vulnerable ip dependency

[madsop-nav]

Describe the feature request

Replace the ip library with for instance ip-address

Background

The ip library has a severe CVE: indutny/node-ip#136

Solution suggestions

No response

[kwasniew]

Thanks for the report. We never use this package to distinguish between public and private IP addresses which is the core of the vulnerability. We're monitoring a PR with a fix anyway: indutny/node-ip#138 and will apply it asap.

[Henning3110]

It seems there was a release this morning without the vulnerability: https://github.com/indutny/node-ip/releases/tag/v2.0.1

[gastonfournier]

@Henning3110 @madsop-nav we'll be patching 5.5.0 with this new version. Will that be enough for your use case?

[madsop-nav]

@Henning3110 @madsop-nav we'll be patching 5.5.0 with this new version. Will that be enough for your use case?

Yes, that'd be sufficient indeed. Thanks!

[Henning3110]

Of course. Thank you for the quick implementation.

[gastonfournier]

https://github.com/Unleash/unleash-client-node/releases/tag/v5.5.1 is out, please reach out if there's any problem! Thanks!