NPM IP package incorrectly identifies some private IP addresses as public

[netra-patwari]

netrapatwari@netras-Air n % npm i

up to date, audited 915 packages in 1s

121 packages are looking for funding
run npm fund for details

1 moderate severity vulnerability

To address all issues, run:
npm audit fix

Run npm audit for details.

netrapatwari@netras-Air n % npm audit

npm audit report

ip 2.0.0
Severity: moderate
NPM IP package incorrectly identifies some private IP addresses as public - GHSA-78xj-cgh5-2h22
fix available via npm audit fix
node_modules/npm/node_modules/ip

1 moderate severity vulnerability

To address all issues, run:
npm audit fix
netrapatwari@netras-Air n %

netrapatwari@netras-Air n % npm audit fix
npm WARN audit fix ip@2.0.0 node_modules/npm/node_modules/ip
npm WARN audit fix ip@2.0.0 is a bundled dependency of
npm WARN audit fix ip@2.0.0 npm@10.2.4 at node_modules/npm
npm WARN audit fix ip@2.0.0 It cannot be fixed automatically.
npm WARN audit fix ip@2.0.0 Check for updates to the npm package.

up to date, audited 915 packages in 2s

121 packages are looking for funding
run npm fund for details

npm audit report

ip 2.0.0
Severity: moderate
NPM IP package incorrectly identifies some private IP addresses as public - GHSA-78xj-cgh5-2h22
fix available via npm audit fix
node_modules/npm/node_modules/ip

1 moderate severity vulnerability

To address all issues, run:
npm audit fix

[niikoo]

I got the same issue. It tells me that a fix is available, but npm audit fix does nothing.

[slmoore]

See my other comment, this is resolved -

Hey @netra-patwari ! I'm seeing the same issue as @niikoo .

I'm finding that running npm audit fix is still installing 2.0.0 instead of 2.0.1. I tried overrides and installing the lastest version as a direct dependency of my application, but 2.0.0 is still being installed.

I'm running node v20.11.1 and npm v10.2.4

    "node_modules/npm/node_modules/ip": {
      "version": "2.0.0",  <----
      "dev": true,
      "inBundle": true,
      "license": "MIT"
    },

[slmoore]

Update! I found a separate dependency was installing the outdated version of ip. I've reached out to that repo's maintainers to resolve this issue. @niikoo or if anyone else is experiencing this issue, check that another of your dependencies is not depending on an older version of ip.

[someonestolemyusername]

Why are people asking for help on how to use npm audit on this repo?