fix: vulerable deps

Author: Mikhus

package-lock.json

@@ -39,36 +39,35 @@
   },
   "homepage": "https://github.com/imqueue/net",
   "dependencies": {
-    "@types/node": "^24.0.10",
-    "bigint-buffer": "^1.1.5",
+    "@types/node": "^24.10.0",
     "ip-regex": "^5.0.0"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.1",
-    "@eslint/js": "^9.30.1",
-    "@types/chai": "^5.2.2",
+    "@eslint/js": "^9.39.1",
+    "@types/chai": "^5.2.3",
     "@types/mocha": "^10.0.10",
     "@types/mock-require": "^3.0.0",
     "@types/sinon": "^17.0.4",
-    "@typescript-eslint/eslint-plugin": "^8.35.1",
-    "@typescript-eslint/parser": "^8.35.1",
-    "@typescript-eslint/typescript-estree": "^8.35.1",
-    "chai": "^5.2.0",
-    "eslint": "^9.30.1",
+    "@typescript-eslint/eslint-plugin": "^8.46.3",
+    "@typescript-eslint/parser": "^8.46.3",
+    "@typescript-eslint/typescript-estree": "^8.46.3",
+    "chai": "^6.2.0",
+    "eslint": "^9.39.1",
     "glob": "^11.0.3",
-    "globals": "^16.3.0",
+    "globals": "^16.5.0",
     "minimist": "^1.2.8",
-    "mocha": "^11.7.1",
+    "mocha": "^11.7.5",
     "mocha-lcov-reporter": "^1.3.0",
     "mock-require": "^3.0.3",
     "npm-scripts-help": "^0.8.0",
     "nyc": "^17.1.0",
-    "open": "^10.1.2",
+    "open": "^10.2.0",
     "sinon": "^21.0.0",
     "source-map-support": "^0.5.21",
     "ts-node": "^10.9.2",
-    "typedoc": "^0.28.7",
-    "typescript": "^5.8.3"
+    "typedoc": "^0.28.14",
+    "typescript": "^5.9.3"
   },
   "main": "index.js",
   "typescript": {

package.json

@@ -22,7 +22,7 @@
 import { NetworkType, sizeOf } from './types';
 import { getType, ipToInt } from './ip-address';
 import { toBinaryList, toIntArray, toStringArray } from './binary-list';
-import { toBigIntLE } from 'bigint-buffer';
+import { toBigIntLE } from './bigint-buffer';
 
 /**
  * Class NetworkList

src/NetworkList.ts

@@ -0,0 +1,52 @@
+/*
+ * Safe local replacements for bigint-buffer utilities: toBigIntLE and toBufferLE
+ * Implemented to avoid dependency on vulnerable bigint-buffer package.
+ */
+
+/**
+ * Converts a little-endian buffer to a bigint value.
+ *
+ * @param {Buffer | Uint8Array} buf
+ * @return {bigint}
+ */
+export function toBigIntLE(buf: Buffer | Uint8Array): bigint {
+    const bytes = buf instanceof Buffer ? buf : Buffer.from(buf);
+    let result = 0n;
+
+    for (let i = 0; i < bytes.length; i++) {
+        result |= BigInt(bytes[i]) << (BigInt(i) * 8n);
+    }
+
+    return result;
+}
+
+/**
+ * Converts a bigint value to a little-endian buffer of a given size.
+ * Throws if the value does not fit into the requested size or is negative.
+ *
+ * @param {bigint} value
+ * @param {number} size - number of bytes in the resulting buffer
+ * @return {Buffer}
+ */
+export function toBufferLE(value: bigint, size: number): Buffer {
+    if (!Number.isInteger(size) || size <= 0) {
+        throw new RangeError('size must be a positive integer');
+    }
+    if (value < 0n) {
+        throw new RangeError('value must be a non-negative bigint');
+    }
+
+    const buf = Buffer.alloc(size);
+    let v = value;
+
+    for (let i = 0; i < size; i++) {
+        buf[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+
+    if (v !== 0n) {
+        throw new RangeError('value does not fit into the specified size');
+    }
+
+    return buf;
+}

src/bigint-buffer.ts

@@ -22,7 +22,7 @@
 import { NetworkType, sizeOf } from './types';
 import { getType } from './ip-address';
 import { cidrToRangeInt, intRangeToCidr } from './cidr';
-import { toBigIntLE, toBufferLE } from 'bigint-buffer';
+import { toBigIntLE, toBufferLE } from './bigint-buffer';
 
 /**
  * Converts given array of CIDR networks to binary format, where all networks

src/binary-list.ts

@@ -25,3 +25,4 @@ export * from './types';
 export * from './binary-list';
 export * from './cidr';
 export * from './ip-address';
+export * from './bigint-buffer';

src/index.ts

@@ -21,7 +21,7 @@
  */
 import { expect } from 'chai';
 import { NetworkList, NetworkType } from '../../src';
-import { toBufferLE } from 'bigint-buffer';
+import { toBufferLE } from '../../src';
 import ipv4mask32 from '../data/ipv4-32.json';
 
 describe('NetworkList', () => {

test/src/NetworkList.ts

@@ -21,7 +21,7 @@
  */
 import { expect } from 'chai';
 import { Networks, NetworkType } from '../../src';
-import { toBufferLE } from 'bigint-buffer';
+import { toBufferLE } from '../../src';
 import ipv4mask32 from '../data/ipv4-32.json';
 
 describe('Networks', () => {