[Snyk] Security upgrade socks-proxy-agent from 4.0.2 to 5.0.0 by dmitriz · Pull Request #14 · dmitriz/node-binance-api

dmitriz · 2025-09-20T06:17:47Z

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Server-side Request Forgery (SSRF) SNYK-JS-IP-12704893	788
	Server-side Request Forgery (SSRF) SNYK-JS-IP-12761655	788

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-IP-12704893 - https://snyk.io/vuln/SNYK-JS-IP-12761655

coderabbitai · 2025-09-20T06:17:54Z

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch snyk-fix-d25a1641720598f5f65027b932b8f39d

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2025-09-20T06:17:56Z

Summary of Changes

Hello @dmitriz, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request is an automated security update initiated by Snyk to enhance the project's security posture. It specifically targets and resolves two critical Server-side Request Forgery (SSRF) vulnerabilities by updating the socks-proxy-agent dependency to its latest secure version. This proactive measure helps mitigate potential security risks associated with outdated dependencies.

Highlights

Security Vulnerability Fix: This pull request addresses and fixes two high-severity Server-side Request Forgery (SSRF) vulnerabilities identified by Snyk.
Dependency Upgrade: The fix is implemented by upgrading the socks-proxy-agent dependency from version 4.0.2 to 5.0.0.
Automated Security Update: This PR was automatically generated by Snyk to ensure the project's dependencies are secure and up-to-date.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This PR addresses two high-severity SSRF vulnerabilities by upgrading socks-proxy-agent from version 4.x to 5.0.0. This is a crucial security fix. However, this is a major version upgrade that introduces breaking changes. As detailed in my comment, the way SocksProxyAgent is instantiated in the code is incompatible with version 5, which will likely break functionality for users relying on a SOCKS proxy. This dependency upgrade should be coupled with code changes to adapt to the new version's API.

gemini-code-assist · 2025-09-20T06:19:01Z

    "https-proxy-agent": "^2.2.1",
    "request": "^2.85.0",
-    "socks-proxy-agent": "^4.0.1",
+    "socks-proxy-agent": "^5.0.0",


Upgrading socks-proxy-agent to a new major version (5.0.0) is important for security, but it introduces breaking changes that will likely break SOCKS proxy functionality in this library.

The constructor for SocksProxyAgent has changed in v5. It now expects the proxy URI as a string, e.g., new SocksProxyAgent('socks://...').

The current implementation in node-binance-api.js (lines 391-395 and 442-446) uses an older constructor pattern with an options object, which is no longer the primary supported method and may be broken.

To fix this, the instantiation of SocksProxyAgent in node-binance-api.js needs to be updated. For example:

// In node-binance-api.js // ... if (socksproxy !== false) { socksproxy = proxyReplacewithIp(socksproxy); if (Binance.options.verbose) Binance.options.log('using socks proxy server ' + socksproxy); let agent = new SocksProxyAgent(socksproxy); // Pass the URI string directly ws = new WebSocket(stream + endpoint, { agent: agent }); // ...

Since node-binance-api.js is not part of this PR's changes, this dependency upgrade should be accompanied by another PR that applies the necessary code changes to maintain compatibility. Without these changes, this upgrade will likely lead to runtime errors for users of SOCKS proxies.

llamapreview

Auto Pull Request Review from LlamaPReview

Review Status: Automated Review Skipped

Dear contributor,

Thank you for your Pull Request. LlamaPReview has analyzed your changes and determined that this PR does not require an automated code review.

Analysis Result:

PR contains only a dependency version bump for security vulnerabilities, with no substantive code changes or logic modifications. The change is limited to updating the 'socks-proxy-agent' version in package.json, which is a routine security update.

We're continuously improving our PR analysis capabilities. Have thoughts on when and how LlamaPReview should perform automated reviews? Share your insights in our GitHub Discussions.

Best regards,
LlamaPReview Team

fix: package.json to reduce vulnerabilities

0ea7b5f

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-IP-12704893 - https://snyk.io/vuln/SNYK-JS-IP-12761655

gemini-code-assist Bot reviewed Sep 20, 2025

View reviewed changes

llamapreview Bot reviewed Sep 20, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade socks-proxy-agent from 4.0.2 to 5.0.0#14

[Snyk] Security upgrade socks-proxy-agent from 4.0.2 to 5.0.0#14
dmitriz wants to merge 1 commit into
masterfrom
snyk-fix-d25a1641720598f5f65027b932b8f39d

dmitriz commented Sep 20, 2025

Uh oh!

coderabbitai Bot commented Sep 20, 2025

Review skipped

Uh oh!

gemini-code-assist Bot commented Sep 20, 2025

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Sep 20, 2025

Uh oh!

llamapreview Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dmitriz commented Sep 20, 2025

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

Uh oh!

coderabbitai Bot commented Sep 20, 2025

Review skipped

Uh oh!

gemini-code-assist Bot commented Sep 20, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Sep 20, 2025

Choose a reason for hiding this comment

Uh oh!

llamapreview Bot left a comment

Choose a reason for hiding this comment

Auto Pull Request Review from LlamaPReview

Review Status: Automated Review Skipped

Analysis Result:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants