search

twilio / twilio-voice-notification-app

Reference app built in ReactJS that demonstrates how to leverage Twilio Programmable Voice and Twilio SDKs to create a voice notification system.
Apache License 2.0
36 stars 26 forks source link

[Snyk] Security upgrade socket.io-client from 2.4.0 to 4.0.0 #72

Open twilio-product-security opened 3 years ago

twilio-product-security commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary Code Injection
SNYK-JS-XMLHTTPREQUESTSSL-1082936		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: socket.io-client The new version differs by 79 commits.
  • d28cde7 chore(release): 4.0.0
  • 43613d1 fix(bundle): restore support for JS modules
  • 6abfa1f feat: add autoUnref option
  • 5902365 feat: add support for typed events
  • 78ec5a6 chore(release): 3.1.2
  • 83a65be chore: bump engine.io-client version
  • 13b32b3 fix: restore support for web workers
  • 311c5d1 chore(release): 3.1.1
  • 7a0c2b5 fix: include the path in the manager ID
  • 61afc5d fix: remove polyfill for process in the bundle
  • 47f917a fix(typings): add return types and general-case overload signatures (#1440)
  • f02ab3b fix(typings): fix the type of the "query" option (#1439)
  • be81a2c chore: point towards the master branch for the CI badge
  • 0a63a17 refactor: remove unused line
  • 5529f34 chore(release): 3.1.0
  • 5d9b4eb chore: bump socket.io-parser version
  • 13e16b9 chore: bump engine.io-client version
  • fe97243 fix(typings): make Manager#opts public (#1437)
  • 4922e39 docs: points towards the website
  • bcdd3be chore(release): 3.0.5
  • cf9fc35 chore: bump debug version
  • 53c7374 fix: emit a connect_error event upon connection failure
  • b83f89c fix(typings): make sendBuffer and receiveBuffer public
  • 8c08c5d refactor: remove global polyfill from webpack config
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic