dependency on "ws" version < 2.00 has security flaw in random number generator

[paulrobello]

"ws" version < 2.00 has security flaw in random number generator

engine.io version 1.8.2
current dependency version "ws 1.1.1"
needs to be "ws >= 2.0.0"

[ekryski]

I saw this as well. See here for more details. https://snyk.io/vuln/npm:ws:20160920

@darrachequesne @rauchg not sure what the implications are but it would probably be good to get a fix in soon. Let me know if/how I can help 😄

[NaLLiFFuNT]

I've faced this problem too.

[lpinca]

On the server this is not a issue as server to client frames are not masked, so it can be ignored here. On the client (engine.io-client) it may be an issue.

We have already backported the fix to the v1.x branch and we plan to release 1.1.2 soon.

I have no internet connection atm as my ISP decided to cancel my contract. I'm using my cell phone now with only few MB of traffic left.

[darrachequesne]

@paulrobello I'll be happy to merge your pull request.

[paulrobello]

@darrachequesne Pull requests created for both server and client

[lpinca]

FYI we also released ws@1.1.2 so you can use that if updating to version 2 is not possible due to the breaking changed.

[darrachequesne]

Released as 1.8.3 and 2.0.2.

@lpinca thanks a lot!

[lpinca]

@darrachequesne you might want to tag version 2.0.2 as latest :)

npm dist-tag add engine.io@2.0.2 latest

currently the "latest" version is 1.8.3.

[darrachequesne]

Done, thanks! (again)