werift library has high severity issue due to 3rd party package

[n0rt0nthec4t]

The source uses the ip library which has known high severity issues with no current fix in place by the package maintainers. see indutny/node-ip#150

This needs to be addressed here, but finding alternate replacement library or code around the requirement

[koush]

that is a nonsense issue and can be ignored. there's been a lot of discussion about this elsewhere.

[n0rt0nthec4t]

Maybe, maybe not, but we should look for ways to mitigate things like this. Given CVE has marked it as high severity and that hasn't changed, docker scout also does the same. Also, ip package appears un-maintained, so it would be prudent to look at moving away from the reliance on the package

[koush]

The project is maintained. It's also complete. ip parsing is a solved problem. there is no need for further updates.

https://socket.dev/blog/node-ip-maintainer-restores-github-repo-after-archiving-due-to-overblown-cve-rating

The issue here is pay per vulnerability hunting incentivizing bogus reports.

[n0rt0nthec4t]

github/advisory-database#4619

Veery much unmaintained by the various comments and threads around. The current high-serv has been raised due to ip v2.0.1 NOT resolving the issue