[BUG] release `npm` with upgraded dependencies to address critical `CVE-2023-42282` about cli

[pog-charlesinglese]

I'd like to request kindly for a new release of npm that isn't dependent directly/indirectly on a vulnerable version of ip module.

[mihob]

Any news on this topic?

[agforero]

@errodrigues This is closed because it's a duplicate of #7216. If you're interested in this, you should follow that thread instead.

[errodrigues]

Thank you.

[brock-rb2t]

thanks for adding! I guess the best response is for npm to update their version of socks, and then devextreme-cli can update their version of npm. Right?

Issue was addressed in ip package 2.0.1, so a package-lock update / release should do the trick for now too.
indutny/node-ip@32f468f

[invariants]

Unfortunately, this is not enough because of the bundleDependencies Key, see: TooTallNate/proxy-agents#288 (comment)

[nam-nguyen-clv]

Duplicated issue #7216

[ljharb]

Duplicate of #7216.

[errodrigues]

I'm sorry but how is this closed? What's the solution here?