Skip to content

[Snyk] Security upgrade engine.io-client from 4.0.0 to 4.1.4#4

Open
snyk-bot wants to merge 2 commits intomasterfrom
snyk-fix-50dc101b02cf7c599576f7c6fe5037f6
Open

[Snyk] Security upgrade engine.io-client from 4.0.0 to 4.1.4#4
snyk-bot wants to merge 2 commits intomasterfrom
snyk-fix-50dc101b02cf7c599576f7c6fe5037f6

Conversation

@snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • examples/latency/package.json
    • examples/latency/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1
Arbitrary Code Injection
SNYK-JS-XMLHTTPREQUESTSSL-1082936
No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: engine.io-client The new version differs by 42 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

…on to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936
@atomist atomist bot added auto-branch-delete:on-close Delete branch when pull request gets closed auto-merge-method:merge Auto-merge with merge commit auto-merge:on-bpr-success Auto-merge on passed branch protection rule labels Jan 16, 2022
Dependencies

* debug > 4.3.3
* engine.io-parser > 4.0.3

Development Dependencies

* eiows > 3.7.3
* eslint-config-prettier > 6.15.0

[atomist:generated]
[atomist-skill:atomist/npm-vulnerability-scanner-skill]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-branch-delete:on-close Delete branch when pull request gets closed auto-merge:on-bpr-success Auto-merge on passed branch protection rule auto-merge-method:merge Auto-merge with merge commit

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants