chore(deps): update dependency engine.io to 3.6.1 [security] - autoclosed

openMF / digital-bank-ui

Digital Bank user interface for staff on top of Fineract CN

Mozilla Public License 2.0

18 stars 28 forks source link

This PR contains the following updates:

Package	Change
engine.io	`1.8.3` -> `3.6.1`

GitHub Vulnerability Alerts

CVE-2020-36048

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

events.js:292
      throw er; // Unhandled 'error' event
      ^

Error: read ECONNRESET
    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  errno: -104,
  code: 'ECONNRESET',
  syscall: 'read'
}

This impacts all the users of the engine.io package, including those who uses depending packages like socket.io.

Patches

A fix has been released today (2022/11/20):

Version range	Fixed version
`engine.io@3.x.y`	`3.6.1`
`engine.io@6.x.y`	`6.2.1`

For socket.io users:

Version range	`engine.io` version	Needs minor update?
`socket.io@4.5.x`	`~6.2.0`	`npm audit fix` should be sufficient
`socket.io@4.4.x`	`~6.1.0`	Please upgrade to `socket.io@4.5.x`
`socket.io@4.3.x`	`~6.0.0`	Please upgrade to `socket.io@4.5.x`
`socket.io@4.2.x`	`~5.2.0`	Please upgrade to `socket.io@4.5.x`
`socket.io@4.1.x`	`~5.1.1`	Please upgrade to `socket.io@4.5.x`
`socket.io@4.0.x`	`~5.0.0`	Please upgrade to `socket.io@4.5.x`
`socket.io@3.1.x`	`~4.1.0`	Please upgrade to `socket.io@4.5.x` (see here)
`socket.io@3.0.x`	`~4.0.0`	Please upgrade to `socket.io@4.5.x` (see here)
`socket.io@2.5.0`	`~3.6.0`	`npm audit fix` should be sufficient
`socket.io@2.4.x` and below	`~3.5.0`	Please upgrade to `socket.io@2.5.0`

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

Open an issue in engine.io

Thanks to Jonathan Neve for the responsible disclosure.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

npm ERR! code ERESOLVE npm ERR! ERESOLVE could not resolve npm ERR! npm ERR! While resolving: @ngrx/core@1.2.0 npm ERR! Found: rxjs@6.5.4 npm ERR! node_modules/rxjs npm ERR! rxjs@"6.5.4" from the root project npm ERR! rxjs@"6.5.4" from @angular-devkit/schematics@9.1.7 npm ERR! node_modules/@angular-devkit/schematics npm ERR! @angular-devkit/schematics@"9.1.7" from @angular/cli@9.1.7 npm ERR! node_modules/@angular/cli npm ERR! dev @angular/cli@"^9.0.4" from the root project npm ERR! @angular-devkit/schematics@"9.1.7" from @schematics/angular@9.1.7 npm ERR! node_modules/@schematics/angular npm ERR! @schematics/angular@"9.1.7" from @angular/cli@9.1.7 npm ERR! node_modules/@angular/cli npm ERR! dev @angular/cli@"^9.0.4" from the root project npm ERR! 1 more (@schematics/update) npm ERR! 20 more (@angular-devkit/core, @angular-devkit/architect, ...) npm ERR! npm ERR! Could not resolve dependency: npm ERR! peer rxjs@"^5.0.0-beta.12" from @ngrx/core@1.2.0 npm ERR! node_modules/@ngrx/core npm ERR! @ngrx/core@"^1.2.0" from the root project npm ERR! npm ERR! Conflicting peer dependency: rxjs@5.5.12 npm ERR! node_modules/rxjs npm ERR! peer rxjs@"^5.0.0-beta.12" from @ngrx/core@1.2.0 npm ERR! node_modules/@ngrx/core npm ERR! @ngrx/core@"^1.2.0" from the root project npm ERR! npm ERR! Fix the upstream dependency conflict, or retry npm ERR! this command with --force, or --legacy-peer-deps npm ERR! to accept an incorrect (and potentially broken) dependency resolution. npm ERR! npm ERR! See /tmp/renovate-cache/others/npm/eresolve-report.txt for a full report. npm ERR! A complete log of this run can be found in: npm ERR! /tmp/renovate-cache/others/npm/_logs/2023-03-11T07_09_42_201Z-debug-0.log

openMF / digital-bank-ui