netmask package issue

Chore summary See

• https://github.com/advisories/GHSA-pch5-whg9-qr2r
• https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918/

Log

❯ yarn why netmask
yarn why v1.22.10
[1/4] 🤔  Why do we have the module "netmask"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
[4/4] 🚡  Calculating file sizes...
=> Found "netmask@1.0.6"
info Reasons this module exists
   - "_project_#smartlint#@stoplight#spectral#proxy-agent#pac-proxy-agent#pac-resolver" depends on it
   - Hoisted from "_project_#smartlint#@stoplight#spectral#proxy-agent#pac-proxy-agent#pac-resolver#netmask"
info Disk size without dependencies: "60KB"
info Disk size with unique dependencies: "60KB"
info Disk size with transitive dependencies: "60KB"
info Number of shared dependencies: 0
✨  Done in 0.53s.

[cmdcarini]

This security vulnerability is already patched with the proxy-agent update to 4.0.1.

We need this patch pushed ASAP, a quick 5.9.1 would be greatly appreciated. I’d be happy to fork off the v5.9.0 tag if some of the changes in the develop branch are not ready

[roubles]

The relevant defect on pac-resolver is: https://github.com/TooTallNate/node-pac-resolver/issues/26

There is a PR out on pac-resolver with netmask updated: https://github.com/TooTallNate/node-pac-resolver/pull/25