search

guardianproject / haven

Haven is for people who need a way to protect their personal spaces and possessions without compromising their own privacy, through an Android app and on-device sensors
https://guardianproject.github.io/haven/
GNU General Public License v3.0
6.63k stars 728 forks source link

Address multiplex vulnerability #438

Closed lukeswitz closed 3 years ago

lukeswitz commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

:sparkles: Snyk has automatically assigned this pull request, set who gets assigned.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-ENGINEIO-1056749		 Yes Proof of Concept
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		 Insecure Defaults
SNYK-JS-SOCKETIO-1024859		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: socket.io The new version differs by 57 commits.
  • 1af3267 chore(release): 3.0.0
  • 02951c4 chore(release): 3.0.0-rc4
  • 54bf4a4 feat: emit an Error object upon middleware error
  • aa7574f feat: serve msgpack bundle
  • 64056d6 docs(examples): update TypeScript example
  • cacad70 chore(release): 3.0.0-rc3
  • d16c035 refactor: rename ERROR to CONNECT_ERROR
  • 5c73733 feat: add support for catch-all listeners
  • 129c641 feat: make Socket#join() and Socket#leave() synchronous
  • 0d74f29 refactor(typings): export Socket class
  • 7603da7 feat: remove prod dependency to socket.io-client
  • a81b9f3 docs(examples): add example with TypeScript
  • 20ea6bd docs(examples): add example with ES modules
  • 0ce5b4c chore(release): 3.0.0-rc2
  • 8a5db7f refactor: remove duplicate _sockets map
  • 2a05042 refactor: add additional typings
  • 91cd255 fix: close clients with no namespace
  • 58b66f8 refactor: hide internal methods and properties
  • 669592d feat: move binary detection back to the parser
  • 2d2a31e chore: publish the wrapper.mjs file
  • ebb0575 chore(release): 3.0.0-rc1
  • c0d171f test: use the reconnect event of the Manager
  • 9c7a48d test: use the complete export name
  • 4bd5b23 feat: throw upon reserved event names
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.