search

zowe / zlux

The top-level superproject for zLUX. zLUX includes the Zowe Desktop framework in addition to several built-in apps and an example server implementation.
Eclipse Public License 2.0
38 stars 42 forks source link

Analyze @rocketsoftware/express-ws 5.0.0 #1012

Open balhar-jakub opened 4 months ago

1000TurquoisePogs commented 4 months ago

This is a fork of express-ws because it had a CVE which was in a dependency. So we forked it to update the dependency ourselves. Since then, there have been 2 more releases of express-ws and it's now slightly newer than our fork. Yet, it's still a relatively unmaintained library, because it points to an outdated ws ( https://github.com/zowe/zlux/issues/1003 )

The best thing to do would be to fork the express-ws library again, but this time to bring it up to ws v8.

1000TurquoisePogs commented 4 months ago

I looked into this more and our fork diverged a little other than simple library differences, so it's a good idea to keep the fork. But, we'll just bring its dependencies up to date.