Repository navigation
Bump socket.io / engine.io / ws to patched versions #3727
Description
The lockfile on dove resolves Socket.IO dependencies that have known high-severity DoS advisories:
| Package | Current | Advisory | Fixed in |
|---|---|---|---|
| engine.io | 6.6.9 | GHSA-2gc4-cqfq-p2gv (protocol revision mismatch DoS) | 6.6.10 |
| socket.io-parser | 4.2.6 | GHSA-2m8v-j782-fhvr (zero-attachment memory exhaustion) | 4.2.7 |
Proposed changes
socket.io/socket.io-client:^4.8.3→^4.8.4inpackages/socketio,packages/socketio-clientandpackages/client- Refresh
package-lock.jsonso it resolvesengine.io@6.6.11,socket.io-parser@4.2.7andws@8.22.0
Since the ranges use ^, downstream users can already pick up the fixes by refreshing their own lockfiles. Bumping the minimums makes sure no new install resolves a vulnerable version.
Activity