fix: move static function from ip to the parse-udp module

[fabianbormann]

What is the purpose of this pull request? (put an "X" next to item)

[ ] Documentation update
[ ] Bug fix
[ ] New feature
[X] Other, please explain:

For the past year, there has been a vulnerability in the less/not maintained node-ip package. While the vulnerability doesn't affect bittorrent-tracker directly, it still results in a 1 high severity vulnerability warning after running npm i on this project or any other project that has bittorrent-tracker as a dependency. This creates a negative impression from a customer perspective or during code audits.

What changes did you make? (Give an overview)

This repository only uses a single static function from the node-ip package, which is unmaintained but available under the MIT license. I copied this static function directly into the parse-udp module and removed the node-ip dependency entirely.

I ran the tests, which show:

1..557
# tests 557
# pass  557

# ok

Additionally, npm i now shows found 0 vulnerabilities after running the command.

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

[fabianbormann]

@DiegoRBaquero, are you the right person to review this PR? If not, could you please involve someone else who could take a look at it? Thanks! 😊

[github-actions]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[fabianbormann]

Please re-open the PR

[subins2000]

This should be re-opened. It's a good change, I noticed the high severity warning as well

[crass]

@fabianbormann I suggest that the commit message be more verbose as to exactly what is happening here. I think you could copy what is in the description above (removing the "For the past year,").

@ThaUnknown I've tested that the issue is real and that this fixes it. It should be a simple and quick review.

[github-actions]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[crass]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

Yes, it is still relevant. There's not much that can be done without an active maintainer to take a look at this.