chore[react-devtools]: ip => internal-ip (#29772)
## Summary There was an attempt to upgrade `ip` to 2.0.1 to mitigate CVE in https://github.com/facebook/react/pull/29725#issuecomment-2150389616, but there actually another one CVE in version `2.0.1`. Instead, migrate to `internal-ip`, which similarly small package that we can use Note: not upgrading to version 7+, because they are pure ESM. ## How did you test this change? Validated that standalone version of RDT works and connects to the app.
Ruslan Lesiutin committed
Jun 5, 2024 at 19:58 UTC
3730b40e9bbacef0279f6d120b344c1544cb38ba
3 files changed
+46
-81
packages/react-devtools/package.json
+1
-1
@@ -25,7 +25,7 @@
25
"dependencies": {
26
"cross-spawn": "^5.0.1",
27
"electron": "^23.1.2",
28
- "ip": "^2.0.1",
28
+ "internal-ip": "^6.2.0",
29
"minimist": "^1.2.3",
30
"react-devtools-core": "5.2.0",
31
"update-notifier": "^2.1.0"
packages/react-devtools/preload.js
+2
-2
@@ -1,11 +1,11 @@
1
const {clipboard, shell, contextBridge} = require('electron');
2
const fs = require('fs');
3
-const {address} = require('ip');
3
+const internalIP = require('internal-ip');
4
5
// Expose protected methods so that render process does not need unsafe node integration
6
contextBridge.exposeInMainWorld('api', {
7
electron: {clipboard, shell},
8
- ip: {address},
8
+ ip: {address: internalIP.v4.sync},
9
getDevTools() {
10
let devtools;
11
try {
yarn.lock
+43
-78
@@ -6498,7 +6498,7 @@ deepmerge@^4.2.2:
6498
resolved "https://registry.yarnpkg.com/deepmerge/-/deepmerge-4.3.1.tgz#44b5f2147cd3b00d4b56137685966f26fd25dd4a"
6499
integrity sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==
6500
6501
-default-gateway@^6.0.3:
6501
+default-gateway@^6.0.0, default-gateway@^6.0.3:
6502
version "6.0.3"
6503
resolved "https://registry.yarnpkg.com/default-gateway/-/default-gateway-6.0.3.tgz#819494c888053bdb743edbf343d6cdf7f2943a71"
6504
integrity sha512-fwSOJsbbNzZ/CUFpqFBqYfYNLj1NbMPm8MMCIzHjC83iSJRBEGmDUxU+WP661BaBQImeC2yHwXtz+P/O9o+XEg==
@@ -7226,7 +7226,7 @@ eslint-utils@^2.0.0, eslint-utils@^2.1.0:
7226
dependencies:
7227
eslint-visitor-keys "^1.1.0"
7228
7229
-"eslint-v7@npm:eslint@^7.7.0":
7229
+"eslint-v7@npm:eslint@^7.7.0", eslint@^7.7.0:
7230
version "7.32.0"
7231
resolved "https://registry.yarnpkg.com/eslint/-/eslint-7.32.0.tgz#c6d328a14be3fb08c8d1d21e12c02fdb7a2a812d"
7232
integrity sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==
@@ -7389,52 +7389,6 @@ eslint@5.16.0:
7389
table "^5.2.3"
7390
text-table "^0.2.0"
7391
7392
-eslint@^7.7.0:
7393
- version "7.32.0"
7394
- resolved "https://registry.yarnpkg.com/eslint/-/eslint-7.32.0.tgz#c6d328a14be3fb08c8d1d21e12c02fdb7a2a812d"
7395
- integrity sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==
7396
- dependencies:
7397
- "@babel/code-frame" "7.12.11"
7398
- "@eslint/eslintrc" "^0.4.3"
7399
- "@humanwhocodes/config-array" "^0.5.0"
7400
- ajv "^6.10.0"
7401
- chalk "^4.0.0"
7402
- cross-spawn "^7.0.2"
7403
- debug "^4.0.1"
7404
- doctrine "^3.0.0"
7405
- enquirer "^2.3.5"
7406
- escape-string-regexp "^4.0.0"
7407
- eslint-scope "^5.1.1"
7408
- eslint-utils "^2.1.0"
7409
- eslint-visitor-keys "^2.0.0"
7410
- espree "^7.3.1"
7411
- esquery "^1.4.0"
7412
- esutils "^2.0.2"
7413
- fast-deep-equal "^3.1.3"
7414
- file-entry-cache "^6.0.1"
7415
- functional-red-black-tree "^1.0.1"
7416
- glob-parent "^5.1.2"
7417
- globals "^13.6.0"
7418
- ignore "^4.0.6"
7419
- import-fresh "^3.0.0"
7420
- imurmurhash "^0.1.4"
7421
- is-glob "^4.0.0"
7422
- js-yaml "^3.13.1"
7423
- json-stable-stringify-without-jsonify "^1.0.1"
7424
- levn "^0.4.1"
7425
- lodash.merge "^4.6.2"
7426
- minimatch "^3.0.4"
7427
- natural-compare "^1.4.0"
7428
- optionator "^0.9.1"
7429
- progress "^2.0.0"
7430
- regexpp "^3.1.0"
7431
- semver "^7.2.1"
7432
- strip-ansi "^6.0.0"
7433
- strip-json-comments "^3.1.0"
7434
- table "^6.0.9"
7435
- text-table "^0.2.0"
7436
- v8-compile-cache "^2.0.3"
7437
-
7392
espree@6.2.1:
7393
version "6.2.1"
7394
resolved "https://registry.yarnpkg.com/espree/-/espree-6.2.1.tgz#77fc72e1fd744a2052c20f38a5b575832e82734a"
@@ -9489,6 +9443,16 @@ inquirer@^6.2.2:
9443
strip-ansi "^5.1.0"
9444
through "^2.3.6"
9445
9446
+internal-ip@^6.2.0:
9447
+ version "6.2.0"
9448
+ resolved "https://registry.yarnpkg.com/internal-ip/-/internal-ip-6.2.0.tgz#d5541e79716e406b74ac6b07b856ef18dc1621c1"
9449
+ integrity sha512-D8WGsR6yDt8uq7vDMu7mjcR+yRMm3dW8yufyChmszWRjcSHuxLBkR3GdS2HZAjodsaGuCvXeEJpueisXJULghg==
9450
+ dependencies:
9451
+ default-gateway "^6.0.0"
9452
+ ipaddr.js "^1.9.1"
9453
+ is-ip "^3.1.0"
9454
+ p-event "^4.2.0"
9455
+
9456
interpret@^1.0.0:
9457
version "1.2.0"
9458
resolved "https://registry.yarnpkg.com/interpret/-/interpret-1.2.0.tgz#d5061a6224be58e8083985f5014d844359576296"
@@ -9519,12 +9483,17 @@ invert-kv@^3.0.0:
9483
resolved "https://registry.yarnpkg.com/invert-kv/-/invert-kv-3.0.1.tgz#a93c7a3d4386a1dc8325b97da9bb1620c0282523"
9484
integrity sha512-CYdFeFexxhv/Bcny+Q0BfOV+ltRlJcd4BBZBYFX/O0u4npJrgZtIcjokegtiSMAvlMTJ+Koq0GBCc//3bueQxw==
9485
9522
-ip@^1.1.4, ip@^1.1.5:
9486
+ip-regex@^4.0.0:
9487
+ version "4.3.0"
9488
+ resolved "https://registry.yarnpkg.com/ip-regex/-/ip-regex-4.3.0.tgz#687275ab0f57fa76978ff8f4dddc8a23d5990db5"
9489
+ integrity sha512-B9ZWJxHHOHUhUjCPrMpLD4xEq35bUTClHM1S6CBU5ixQnkZmwipwgc96vAd7AAGM9TGHvJR+Uss+/Ak6UphK+Q==
9490
+
9491
+ip@^1.1.5:
9492
version "1.1.5"
9493
resolved "https://registry.yarnpkg.com/ip/-/ip-1.1.5.tgz#bdded70114290828c0a039e72ef25f5aaec4354a"
9494
integrity sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=
9495
9527
-ipaddr.js@1.9.1:
9496
+ipaddr.js@1.9.1, ipaddr.js@^1.9.1:
9497
version "1.9.1"
9498
resolved "https://registry.yarnpkg.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz#bff38543eeb8984825079ff3a2a8e6cbd46781b3"
9499
integrity sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==
@@ -9778,6 +9747,13 @@ is-installed-globally@^0.3.1:
9747
global-dirs "^2.0.1"
9748
is-path-inside "^3.0.1"
9749
9750
+is-ip@^3.1.0:
9751
+ version "3.1.0"
9752
+ resolved "https://registry.yarnpkg.com/is-ip/-/is-ip-3.1.0.tgz#2ae5ddfafaf05cb8008a62093cf29734f657c5d8"
9753
+ integrity sha512-35vd5necO7IitFPjd/YBeqwWnyDWbuLH9ZXQdMfDA8TEo7pv5X8yfrvVO3xbJbLUlERCMvf6X0hTUamQxCYJ9Q==
9754
+ dependencies:
9755
+ ip-regex "^4.0.0"
9756
+
9757
is-jpg@^2.0.0:
9758
version "2.0.0"
9759
resolved "https://registry.yarnpkg.com/is-jpg/-/is-jpg-2.0.0.tgz#2e1997fa6e9166eaac0242daae443403e4ef1d97"
@@ -12389,6 +12365,13 @@ p-event@^2.1.0:
12365
dependencies:
12366
p-timeout "^2.0.1"
12367
12368
+p-event@^4.2.0:
12369
+ version "4.2.0"
12370
+ resolved "https://registry.yarnpkg.com/p-event/-/p-event-4.2.0.tgz#af4b049c8acd91ae81083ebd1e6f5cae2044c1b5"
12371
+ integrity sha512-KXatOjCRXXkSePPb1Nbi0p0m+gQAwdlbhi4wQKJPI1HsMQS9g+Sqp2o+QHziPr7eYJyOZet836KoHEVM1mwOrQ==
12372
+ dependencies:
12373
+ p-timeout "^3.1.0"
12374
+
12375
p-finally@^1.0.0:
12376
version "1.0.0"
12377
resolved "https://registry.yarnpkg.com/p-finally/-/p-finally-1.0.0.tgz#3fbcfb15b899a44123b34b6dcc18b724336a2cae"
@@ -12485,6 +12468,13 @@ p-timeout@^2.0.1:
12468
dependencies:
12469
p-finally "^1.0.0"
12470
12471
+p-timeout@^3.1.0:
12472
+ version "3.2.0"
12473
+ resolved "https://registry.yarnpkg.com/p-timeout/-/p-timeout-3.2.0.tgz#c7e17abc971d2a7962ef83626b35d635acf23dfe"
12474
+ integrity sha512-rhIwUycgwwKcP9yTOOFK/AKsAopjjCakVqLHePO3CC6Mir1Z99xT+R63jZxAT5lFZLa2inS5h+ZS2GvR99/FBg==
12475
+ dependencies:
12476
+ p-finally "^1.0.0"
12477
+
12478
p-try@^2.0.0:
12479
version "2.2.0"
12480
resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz#cb2868540e313d61de58fafbe35ce9004d5540e6"
@@ -14987,7 +14977,7 @@ string-natural-compare@^3.0.1:
14977
resolved "https://registry.yarnpkg.com/string-natural-compare/-/string-natural-compare-3.0.1.tgz#7a42d58474454963759e8e8b7ae63d71c1e7fdf4"
14978
integrity sha512-n3sPwynL1nwKi3WJ6AIsClwBMa0zTi54fn2oLU6ndfTSIO05xaznjSf15PcBZU6FNWbmN5Q6cxT4V5hGvB4taw==
14979
14990
-"string-width-cjs@npm:string-width@^4.2.0":
14980
+"string-width-cjs@npm:string-width@^4.2.0", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
14981
version "4.2.3"
14982
resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
14983
integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -15022,15 +15012,6 @@ string-width@^4.0.0:
15012
is-fullwidth-code-point "^3.0.0"
15013
strip-ansi "^6.0.0"
15014
15025
-string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
15026
- version "4.2.3"
15027
- resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
15028
- integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
15029
- dependencies:
15030
- emoji-regex "^8.0.0"
15031
- is-fullwidth-code-point "^3.0.0"
15032
- strip-ansi "^6.0.1"
15033
-
15015
string-width@^5.0.1, string-width@^5.1.2:
15016
version "5.1.2"
15017
resolved "https://registry.yarnpkg.com/string-width/-/string-width-5.1.2.tgz#14f8daec6d81e7221d2a357e668cab73bdbca794"
@@ -15091,7 +15072,7 @@ string_decoder@~1.1.1:
15072
dependencies:
15073
safe-buffer "~5.1.0"
15074
15094
-"strip-ansi-cjs@npm:strip-ansi@^6.0.1":
15075
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1", strip-ansi@^6.0.0, strip-ansi@^6.0.1:
15076
version "6.0.1"
15077
resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
15078
integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
@@ -15119,13 +15100,6 @@ strip-ansi@^5.1.0:
15100
dependencies:
15101
ansi-regex "^4.1.0"
15102
15122
-strip-ansi@^6.0.0, strip-ansi@^6.0.1:
15123
- version "6.0.1"
15124
- resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
15125
- integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
15126
- dependencies:
15127
- ansi-regex "^5.0.1"
15128
-
15103
strip-ansi@^7.0.1:
15104
version "7.1.0"
15105
resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.1.0.tgz#d5b6568ca689d8561370b0707685d22434faff45"
@@ -16573,7 +16547,7 @@ workerize-loader@^2.0.2:
16547
dependencies:
16548
loader-utils "^2.0.0"
16549
16576
-"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
16550
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0", wrap-ansi@^7.0.0:
16551
version "7.0.0"
16552
resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
16553
integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
@@ -16591,15 +16565,6 @@ wrap-ansi@^6.2.0:
16565
string-width "^4.1.0"
16566
strip-ansi "^6.0.0"
16567
16594
-wrap-ansi@^7.0.0:
16595
- version "7.0.0"
16596
- resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
16597
- integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
16598
- dependencies:
16599
- ansi-styles "^4.0.0"
16600
- string-width "^4.1.0"
16601
- strip-ansi "^6.0.0"
16602
-
16568
wrap-ansi@^8.1.0:
16569
version "8.1.0"
16570
resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-8.1.0.tgz#56dc22368ee570face1b49819975d9b9a5ead214"