Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade socket.io-client from 2.3.1 to 4.0.0 #171

Merged
merged 1 commit into from
Nov 7, 2021

Conversation

snyk-bot
Copy link
Contributor

@snyk-bot snyk-bot commented May 5, 2021

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1
Arbitrary Code Injection
SNYK-JS-XMLHTTPREQUESTSSL-1082936
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: socket.io-client The new version differs by 79 commits.
  • d28cde7 chore(release): 4.0.0
  • 43613d1 fix(bundle): restore support for JS modules
  • 6abfa1f feat: add autoUnref option
  • 5902365 feat: add support for typed events
  • 78ec5a6 chore(release): 3.1.2
  • 83a65be chore: bump engine.io-client version
  • 13b32b3 fix: restore support for web workers
  • 311c5d1 chore(release): 3.1.1
  • 7a0c2b5 fix: include the path in the manager ID
  • 61afc5d fix: remove polyfill for process in the bundle
  • 47f917a fix(typings): add return types and general-case overload signatures (#1440)
  • f02ab3b fix(typings): fix the type of the "query" option (#1439)
  • be81a2c chore: point towards the master branch for the CI badge
  • 0a63a17 refactor: remove unused line
  • 5529f34 chore(release): 3.1.0
  • 5d9b4eb chore: bump socket.io-parser version
  • 13e16b9 chore: bump engine.io-client version
  • fe97243 fix(typings): make Manager#opts public (#1437)
  • 4922e39 docs: points towards the website
  • bcdd3be chore(release): 3.0.5
  • cf9fc35 chore: bump debug version
  • 53c7374 fix: emit a connect_error event upon connection failure
  • b83f89c fix(typings): make sendBuffer and receiveBuffer public
  • 8c08c5d refactor: remove global polyfill from webpack config

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@coveralls
Copy link

coveralls commented May 5, 2021

Coverage Status

Coverage remained the same at 82.101% when pulling 1d68eda on snyk-fix-a72cb90f2dcdf1da94e6c4165b060dc3 into 20300cd on master.

@jupe jupe merged commit 3640e5f into master Nov 7, 2021
@jupe jupe deleted the snyk-fix-a72cb90f2dcdf1da94e6c4165b060dc3 branch November 7, 2021 12:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants