Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix #1251 Upgrade the minimum version of "ws" package #1322

Merged
merged 1 commit into from
Aug 29, 2021

Conversation

seratch
Copy link
Member

@seratch seratch commented Aug 27, 2021

Summary

This pull request fixes #1251 by upgrading the minimum version of "ws" package in socket-mode / rtm-api packages.

As you can see in the GitHub release page, a number of bug fixes have been applied in ws@7 series. As most of Socket Mode clients won't have version conflict issues on "ws" package with other parts of those apps, encouraging developers to use the latest patch version should be just safe enough.

"ws" project recently released a new major version v8 (the latest minor is v8.2). We haven't received any reports about the compatibility. Just in case, I did some tests with ws@8 today but didn't detect any issues so far. For this reason, I think that we don't need to limit the upper to v7.x so far.

Requirements (place an x in each [ ])

Copy link
Member

@mwbrooks mwbrooks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for testing with [email protected] as well. I agree that we can keep it at [email protected] until we there's a stronger reason to force 8.0+

@seratch
Copy link
Member Author

seratch commented Aug 29, 2021

Thanks. v8 is one month old. Holding off forcing v8 should be fine so far.

@seratch seratch merged commit 5dab223 into slackapi:main Aug 29, 2021
@seratch seratch deleted the issue-1251-ws branch August 29, 2021 07:23
@300LiterPropofol
Copy link

Sorry that I have a confusion here. I reinstalled @slack/bolt but the ws version in package-lock.json is till 7. And I manually npm install [email protected] but I found the dependency of @slack/socket-mode in is still ws@7. How can I use ws8 in slack bolt here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkg:rtm-api applies to `@slack/rtm-api` pkg:socket-mode applies to `@slack/socket-mode` semver:patch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2021-32640 - "ws" is vulnerable to ReDoS attacks
3 participants