search

koajs / koa.io

[MAINTAINERS WANTED] Realtime web framework combine koa and socket.io.
429 stars 52 forks source link

[Snyk] Security upgrade socket.io from 1.3.7 to 2.0.0 #83

Closed fengmk2 closed 5 months ago

fengmk2 commented 11 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Denial of Service (DoS)
[SNYK-JS-SOCKETIOPARSER-1056752](https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-1056752) | Yes | Proof of Concept ![critical severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/c.png "critical severity") | **704/1000**
**Why?** Has a fix available, CVSS 9.8 | Improper Input Validation
[SNYK-JS-SOCKETIOPARSER-3091012](https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012) | Yes | No Known Exploit ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **589/1000**
**Why?** Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[npm:parsejson:20170908](https://snyk.io/vuln/npm:parsejson:20170908) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: socket.io The new version differs by 250 commits.
  • 3367eaa [chore] Release 2.0.0
  • 6c0705f [docs] Add an example of custom parser (#2929)
  • 1980fb4 [chore] Merge history of 1.7.x and 0.9.x branches (#2930)
  • 0d07c47 [chore] Added backers and sponsors on the README (#2933)
  • a086588 [chore] Bump dependencies (#2926)
  • 87b06ad [feat] Move binary detection to the parser (#2923)
  • 199eec6 [docs] Replace non-breaking space with proper whitespace (#2913)
  • f1b39a6 [docs] Update emit cheatsheet (#2906)
  • 240b154 [docs] Explicitly document that Server extends EventEmitter (#2874)
  • c5b7738 [docs] Add server.engine.generateId attribute (#2880)
  • 03f3bc9 [docs] Fix wrong space character in README (#2900)
  • e40accf [docs] Fix documentation for 'connect' event (#2898)
  • 01a4623 [feat] Allow to join several rooms at once (#2879)
  • 2d5b002 [docs] Add webpack build example (#2828)
  • 5ae06e6 [chore] Bump socket.io-adapter to version 1.0.0 (#2867)
  • 4d8f68c [chore] Bump engine.io to version 2.0.2 (#2864)
  • 5b79ab1 [docs] Update the wording to match the code example (#2853)
  • 54ff591 [feature] Merge Engine.IO and Socket.IO handshake packets (#2833)
  • e1facd5 [docs] Small addition to the Express Readme Part (#2846)
  • 3b92cc2 [feature] Allow the use of custom parsers (#2829)
  • 3d695c6 [chore] Bump engine.io to version 2.0.0 (#2832)
  • 3b5f433 [fix] Use path.resolve by default and require.resolve as a fallback (#2797)
  • 23c9dd3 [docs] Add a 'Features' section in the README (#2824)
  • e28b475 [docs] Add httpd cluster example (#2819)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/fengmk2/project/acea9b8e-53e2-435d-aff6-8d00fa148b5e?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/fengmk2/project/acea9b8e-53e2-435d-aff6-8d00fa148b5e?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"8085c419-d989-4ace-86ae-1a7f0b7f9970","prPublicId":"8085c419-d989-4ace-86ae-1a7f0b7f9970","dependencies":[{"name":"socket.io","from":"1.3.7","to":"2.0.0"}],"packageManager":"npm","projectPublicId":"acea9b8e-53e2-435d-aff6-8d00fa148b5e","projectUrl":"https://app.snyk.io/org/fengmk2/project/acea9b8e-53e2-435d-aff6-8d00fa148b5e?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-SOCKETIOPARSER-1056752","SNYK-JS-SOCKETIOPARSER-3091012","npm:parsejson:20170908"],"upgrade":["SNYK-JS-SOCKETIOPARSER-1056752","SNYK-JS-SOCKETIOPARSER-3091012","npm:parsejson:20170908"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[696,704,589],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Denial of Service (DoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr) 🦉 [Improper Input Validation](https://learn.snyk.io/lesson/sql-injection/?loc=fix-pr)
socket-security[bot] commented 11 months ago

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
socket.io 2.0.0 network, filesystem, environment +30 16.3 MB darrachequesne