nestjs / graphql

GraphQL (TypeScript) module for Nest framework (node.js) 🍷
https://docs.nestjs.com/graphql/quick-start
MIT License
1.45k stars 391 forks source link

[security] Upgrades the version of the WS package #3216

Closed ojengwa closed 2 months ago

ojengwa commented 2 months ago

PR Checklist

Please check if your PR fulfills the following requirements:

PR Type

What kind of change does this PR introduce?

What is the current behavior?

Issue Number: 3215

What is the new behavior? https://github.com/advisories/GHSA-3h5v-q93c-6h6q

Does this PR introduce a breaking change?

Other information

sawilde commented 2 months ago

this package has a dependancy on subscriptions-transport-ws which in turn has a dependancy on ws 5,6,7 and so we are still exposed to the reported ws vulnerability

image

This package however is no longer maintained and it is recommended to switch to graphql-ws instead

image

kamilmysliwiec commented 2 months ago

https://github.com/nestjs/graphql/pull/3217