[Snyk] Security upgrade socks from 2.7.1 to 2.7.2

[admin-token-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	823/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.6	Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: socks

The new version differs by 4 commits.

• b428d7c bleh
• df8e077 3.0.0
• 209c398 update github workflow
• 0c016fc remove ip package

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)

[abhishandilya]

Can we please upgrade socks to 2.7.3 which removes "ip" from the dependencies?

[yukha-dw]

I believe there's an issue on their versioning, version 2.7.2 and 2.7.3 are identical. But, only verison 2.7.3 is registered in their GitHub.

[afcgoncalves]

Should be 2.7.3 as mentioned in JoshGlazebrook/socks#93 (comment)

[mertssmnoglu]

There is an open PR for this. It's also includes other peer and dev dependencies.

#3994

[nbbeeken]

Hey folks, this automated PR and the related #3994 are not going to have any downstream effect.

The MongoDB driver v6 depends on socks as an optional peer dependency which means the version you install should be managed by your project's package.json. Since we use ^2.7.1 as the permitted range this means any minor or patch version above that should be installable and compatible with the driver.

The v5 and v4 versions of the driver have socks as a dependency but with the same semver range. The means npm will allow socks versions later than 2.7.1 to be installed alongside the driver and consider them compatible. Probably, the easiest way to get socks to upgrade is: npm rm mongodb && npm i mongodb@VERSION where VERSION was the current driver version you are using.

We'll still be upgrading the devDependency for our sake in the other PR so, I'll close this.