fix: remove vulnerable dependencies and resolve npm audit findings (#453)

- replace ip-cidr and crypto-browserify with ipaddr.js and native
node:crypto, bump mathjs to v15, and update semantic-release's nested
@actions/http-client/undici chain to close all reported vulnerabilities.

Author: jcbsfilho

package-lock.json

@@ -277,15 +277,14 @@
     "browserify-zlib": "^0.2.0",
     "chalk": "^5.6.2",
     "cookie": "^1.0.2",
-    "crypto-browserify": "^3.12.1",
     "dotenv": "^17.2.2",
     "esbuild": "^0.25.10",
     "events": "^3.3.0",
     "fast-glob": "^3.3.3",
     "inherits": "^2.0.4",
-    "ip-cidr": "^4.0.2",
+    "ipaddr.js": "^2.4.0",
     "lodash-es": "^4.17.21",
-    "mathjs": "^13.1.1",
+    "mathjs": "^15.2.0",
     "mime": "^4.1.0",
     "mime-types": "^3.0.1",
     "pcre-to-regexp": "^1.1.0",

package.json

@@ -42,7 +42,7 @@
     "esbuild": "^0.25.10",
     "events": "^3.3.0",
     "inherits": "^2.0.4",
-    "ip-cidr": "^4.0.2",
+    "ipaddr.js": "^2.4.0",
     "lodash-es": "^4.17.21",
     "mime": "^4.1.0",
     "mime-types": "^3.0.1",

packages/bundler/package.json

@@ -1,4 +1,4 @@
-import ipCidrLib from 'ip-cidr';
+import ipaddr from 'ipaddr.js';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import nodePath from 'node:path';
@@ -71,8 +71,7 @@ class NetworkListContext {
     return listContent.some((currentIp) => {
       if (currentIp.includes('/')) {
         try {
-          const cidr = new ipCidrLib(currentIp);
-          return cidr.contains(ipAddress);
+          return ipaddr.parse(ipAddress).match(ipaddr.parseCIDR(currentIp));
         } catch {
           return false; // Invalid CIDR format
         }

packages/bundler/src/polyfills/azion/network-list/context/network-list.context.js

@@ -36,7 +36,7 @@
     "ajv": "^8.17.1",
     "ajv-errors": "^3.0.0",
     "ajv-keywords": "^5.1.0",
-    "mathjs": "^13.1.1"
+    "mathjs": "^15.2.0"
   },
   "devDependencies": {
     "@jest/globals": "^29.7.0",

packages/config/package.json

@@ -25,8 +25,5 @@
     "dist",
     "package.json",
     "src/polyfills/*"
-  ],
-  "dependencies": {
-    "crypto-browserify": "^3.12.1"
-  }
+  ]
 }