NPM IP package warning overstates danger

[matkoniecz]

See indutny/node-ip#136 (comment)

You're only vulnerable to anything remotely close to what the advisory talks about if:

You have a vulnerable version of ip in your deps
and you or your dependencies use the isPublic() function
and that function is used to guard something sensitive
and the input you pass to isPublic() is user input

Only then, you have a problem.

[dotboris]

I've opened this PR #3531 to change the advisory to better represent the actual situation.

[KateCatlin]

Looks like this issue was resolved in our community contributions UI, so I'll go ahead and close this issue. Thanks to both of you!