Dependabot: ip SSRF improper categorization in isPublic

[tlindsay42]

Package: ip (npm)
Affected versions: <= 2.0.1
Patched version: None

Locations:

• application-code/nodejs-demoapp/src/package-lock.json
• application-code/ecsdemo-nodejs/package-lock.json

Dependabot couldn't auto-generate a ticket for this, so manually creating.

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.