titanscouting / red-alliance-mobile

Red Alliance App in React
2 stars 6 forks source link

[Snyk] Upgrade socket.io-client from 4.2.0 to 4.3.2 #171

Closed snyk-bot closed 2 years ago

snyk-bot commented 2 years ago

Snyk has created this PR to upgrade socket.io-client from 4.2.0 to 4.3.2.

merge advice :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1023599
482/1000
Why? Proof of Concept exploit, CVSS 7.5
Proof of Concept
Command Injection
SNYK-JS-LODASH-1040724
482/1000
Why? Proof of Concept exploit, CVSS 7.5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1072471
482/1000
Why? Proof of Concept exploit, CVSS 7.5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-PROMPTS-1729737
482/1000
Why? Proof of Concept exploit, CVSS 7.5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
482/1000
Why? Proof of Concept exploit, CVSS 7.5
Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: socket.io-client
  • 4.3.2 - 2021-10-16

    Bug Fixes

    • restore the default export (bis) (6780f29)

    Links:

    • Diff: 4.3.1...4.3.2
    • Server release: -
    • engine.io-client version: ~6.0.1
    • ws version: ~8.2.3

    Size of the bundles:

    min min+gzip
    socket.io.min.js 40.0 KB (-) 13.0 KB (-)
    socket.io.msgpack.min.js 45.2 KB (-) 14.2 KB (-)
    socket.io.esm.min.js 32.8 KB (-) 11.1 KB (-)
  • 4.3.1 - 2021-10-15

    Bug Fixes

    • restore the default export (f0aae84)
    • restore the namespace export (8737d0a)

    Links:

    • Diff: 4.3.0...4.3.1
    • Server release: -
    • engine.io-client version: ~6.0.1
    • ws version: ~8.2.3

    Size of the bundles:

    min min+gzip
    socket.io.min.js 40.0 KB (+ 0.1 KB ⬆️) 13.0 KB (+ 0.1 KB ⬆️)
    socket.io.msgpack.min.js 45.2 KB (+ 0.1 KB ⬆️) 14.2 KB (+ 0.1 KB ⬆️)
    socket.io.esm.min.js 32.8 KB (+ 0.1 KB ⬆️) 11.1 KB (-)
  • 4.3.0 - 2021-10-14

    An ESM bundle is now provided:

    <script type="module">
      import { io } from "https://cdn.socket.io/4.3.0/socket.io.esm.min.js";
    
      const socket = io();
    
      socket.emit("hello", "world");
    </script>

    The bundle size has also been greatly reduced, from 16.0 KB to 12.9 KB (min+gzip).

    Features

    • typings: add missing types for some emitter methods (#1502) (a9e5b85)
    • provide an ESM build with and without debug (16b6569)
    • migrate to rollup (0661564)

    Links:

    Size of the bundles:

    min  min+gzip
    socket.io.min.js 39.9 KB (-24.6 KB ⬇️) 12.9 KB (-3.1 KB ⬇️)
    socket.io.msgpack.min.js 45.1 KB (-25.6 KB ⬇️) 14 KB (-2.6 KB ⬇️)
    socket.io.esm.min.js 32.7 KB 11.1 KB
  • 4.2.0 - 2021-08-30

    Bug Fixes

    • typings: allow async listener in typed events (66e00b7)
    • allow to set randomizationFactor to 0 (#1447) (dfb46b5)

    Features

    • add an option to use native timer functions (#1479) (4e1b656)

    Links:

    • Diff: 4.1.3...4.2.0
    • Server release: 4.2.0
    • engine.io-client version: ~5.2.0
    • ws version: ~7.4.2
    • Build size
      • socket.io.min.js: 64.5 KB (+ 1.5 KB)
      • socket.io.msgpack.min.js: 65.5 KB (+ 1.4 KB)
from socket.io-client GitHub release notes
Commit messages
Package name: socket.io-client
  • da0b828 chore(release): 4.3.2
  • 6780f29 fix: restore the default export (bis)
  • ca614b2 chore(release): 4.3.1
  • f0aae84 fix: restore the default export
  • 8737d0a fix: restore the namespace export
  • c76d367 chore(release): 4.3.0
  • 91b948b refactor: move the typed events to @ socket.io/component-emitter
  • a9e5b85 feat(typings): add missing types for some emitter methods (#1502)
  • 0661564 chore: migrate to rollup
  • 16b6569 feat: provide an ESM build with and without debug
  • 7187453 chore: bump socket.io-parser to version 4.1.0
  • 91fbd47 chore: bump engine.io-client to version 6.0.0
Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs