Repository navigation
fix(run-e2e): drop vulnerable ip package - #2525
Merged
Merged
Conversation
This comment has been minimized.
This comment has been minimized.
samuelreichert
force-pushed
the
fix/snyk-vulnerabilities
branch
from
November 12, 2026 13:10
b2b724e to
3ab330d
Compare
samuelreichert
changed the title
ip@2.0.1 has three SSRF advisories with no fixed release. It was only used to find the host's IPv4 address for the e2e containers, which node:os networkInterfaces() gives directly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
samuelreichert
force-pushed
the
fix/snyk-vulnerabilities
branch
from
November 12, 2026 13:29
3ab330d to
d49ded9
Compare
Contributor
AI Code Review
What was reviewed
Skipped (out of scope): none CI: pending: Run code quality check, Plan E2E matrix, sigridci · unrelated failures: security/snyk (the failing check is the external scanner, which should clear once it re-scans after Positives
|
iobuhov
approved these changes
Nov 12, 2026
leonardomendix
approved these changes
Nov 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request type
Dependency changes (any modification to dependencies in
package.json)Description
Removes the
ipdependency fromautomation/run-e2e.ip@2.0.1has three SSRF advisories (CVE-2024-29415, CVE-2025-59436, CVE-2025-59437). All versions are affected and there is no fixed release, so Snyk flagsautomation/run-e2eon every PR.The package was only used for
ip.address(), to find the host's IPv4 address that the e2e containers use to reach the host. This is replaced with a smallnode:osnetworkInterfaces()lookup that returns the first external IPv4 address. If none is found, the existing "Could not determine local ip address!" error is thrown. Before,ipsilently fell back to127.0.0.1, which containers can't use to reach the host anyway.The lockfile change is limited to removing
ip.This only affects the default bridge mode. The host-network mode added in #2518 (
E2E_HOST_NETWORK) still uses127.0.0.1.What should be covered while testing?
pnpm run lintinautomation/run-e2epasses.pnpm run e2ewith Docker) still starts the runtime container and reaches it from Playwright.security/snykno longer reportsipforautomation/run-e2e. Other existing advisories, such asbraces, are out of scope.🤖 Generated with Claude Code