Upgrade the es5-ext package to 0.10.64 to resolve CVE-2024-27088.
I am aware of this previous PR pinning the version, but it doesn't seem like it was working as version 0.10.62 was installed which still includes the war messaging.
Other Tasks:
[ ] If you updated the Go SDK did you update the PackageVersion in tunnels.go
[X] If you updated the TS SDK did you update the dependencies in package.json for connections and management to require a dependency that is > the current published version(Found using npm view @microsoft/dev-tunnels-contracts). This will fix issues where yarn will pull the old version of packages and will cause mismatched dependencies. See example PR
Changes proposed:
Upgrade the
es5-ext
package to 0.10.64 to resolve CVE-2024-27088.I am aware of this previous PR pinning the version, but it doesn't seem like it was working as version
0.10.62
was installed which still includes the war messaging.Other Tasks:
npm view @microsoft/dev-tunnels-contracts
). This will fix issues where yarn will pull the old version of packages and will cause mismatched dependencies. See example PR