Package vulnerabilities in version 0.20

Hi, this package depends on vulnerable packages posing a "high" risk.
I am using the latest version 0.20

Please update them!

Packages:
- semver 7.3.1
- socks (depends on ip which is vulnerable)

ip *
Severity: high
NPM IP package incorrectly identifies some private IP addresses as public - https://github.com/advisories/GHSA-78xj-cgh5-2h22
ip SSRF improper categorization in isPublic - https://github.com/advisories/GHSA-2p57-rm9w-gvfp
fix available via `npm audit fix`
node_modules/npm/node_modules/ip
socks 1.0.0 - 2.7.1
Depends on vulnerable versions of ip
node_modules/npm/node_modules/socks

semver 7.0.0 - 7.5.1
Severity: high
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
No fix available
node_modules/npm/node_modules/semver
npm <=9.9.3 || 10.0.0-pre.0 - 10.5.0
Depends on vulnerable versions of semver
Depends on vulnerable versions of tar
node_modules/npm
azure-kusto-trender *
Depends on vulnerable versions of npm
node_modules/azure-kusto-trender

npm list ip
└─┬ azure-kusto-trender@0.0.20
└─┬ npm@8.19.4
└─┬ make-fetch-happen@10.2.1
└─┬ socks-proxy-agent@7.0.0
└─┬ socks@2.7.0
└── ip@2.0.0

npm list semver
azure-kusto-trender@0.0.20
│ └─┬ npm@8.19.4
│ ├─┬ @npmcli/arborist@5.6.3
│ │ ├─┬ @npmcli/metavuln-calculator@3.1.1
│ │ │ └── semver@7.3.7 deduped
│ │ ├─┬ @npmcli/query@1.2.0
│ │ │ └── semver@7.3.7 deduped
│ │ └── semver@7.3.7 deduped
│ ├─┬ @npmcli/config@4.2.2
│ │ └── semver@7.3.7 deduped
│ ├─┬ @npmcli/fs@2.1.2
│ │ └── semver@7.3.7 deduped
│ ├─┬ init-package-json@3.0.2
│ │ └── semver@7.3.7 deduped
│ ├─┬ libnpmexec@4.0.14
│ │ └── semver@7.3.7 deduped
│ ├─┬ libnpmpublish@6.0.5
│ │ ├─┬ normalize-package-data@4.0.1
│ │ │ └── semver@7.3.7 deduped
│ │ └── semver@7.3.7 deduped
│ ├─┬ libnpmversion@3.0.7
│ │ ├─┬ @npmcli/git@3.0.2
│ │ │ └── semver@7.3.7 deduped
│ │ └── semver@7.3.7 deduped
│ ├─┬ node-gyp@9.1.0
│ │ └── semver@7.3.7 deduped
│ ├─┬ npm-install-checks@5.0.0
│ │ └── semver@7.3.7 deduped
│ ├─┬ npm-package-arg@9.1.0
│ │ └── semver@7.3.7 deduped
│ ├─┬ npm-pick-manifest@7.0.2
│ │ └── semver@7.3.7 deduped
│ ├── semver@7.3.7
│ └─┬ validate-npm-package-name@4.0.0
│ └─┬ builtins@5.0.1
│ └── semver@7.3.7 deduped

Thank you!

BR Jonas

Start by reproducing the report with npm audit and the npm list ip and npm list semver commands shown. Trace azure-kusto-trender's npm@8.19.4 dependency chain and check whether available upgrades remove the vulnerable packages; done requires an updated dependency tree without the reported high-severity issues, or a documented blocker for semver.

Written by the indexing model from the issue text.