CVE-2023-42282 An issue in NPM IP Package when scanning with trivy about docker-node HOT 5 CLOSED

That needs to be fixed in ip, then adopted in npm, then npm must be updated in node. At that point the fix will trickle down to the docker image

from docker-node.

But it looks like the IP project is not maintained anymore. Last commit was 2 years ago. You need to remove/replace the package.

from docker-node.

npm is a separate product and not maintained by Node.js, much less the Node.js Docker folks. You need to raise this with npm Inc.

from docker-node.

Hi @SimenB @meyfa. I am still facing this issue and would appreciate your help and guidance.
From my analysis, the IP package used by the node image is version 2.0.0. Fix suggestions show that this vulnerability has been fixed for versions 1.1.9 and 2.0.1.
The base image I am using: node:20.11.0-bookworm-slim
If the fixes are rolled out, could you guide me to the best image or advice on how to patch this?
I tried manually updating the IP package in the Dockerfile, but it does not work and all of the variations of the node base image I checked (including 20.11.1) still show this vulnerability.

from docker-node.

https://github.com/nodejs/docker-node/blob/main/SECURITY.md

from docker-node.