Skip to content

refresh lockfile to automatically remove the high severity vulnerabilities introduced by xmlhttprequest-ssl@1.5.5 #216

@paimon0715

Description

@paimon0715

Hi, @ArtyomHov, I have reported a vulnerability issue in package engine.io-client.

As far as I am aware, vulnerability(high severity) CVE-2021-31597 and CVE-2020-28502 detected in package xmlhttprequest-ssl<1.6.1 is directly referenced by  engine.io-client@3.3.2, on which your package @renderforest/sdk-node@0.11.2 transitively depends. As such, this vulnerability can also affect @renderforest/sdk-node@0.11.2 via the following path:
@renderforest/sdk-node@0.11.2 ➔ socket.io-client@2.2.0 ➔ engine.io-client@3.3.2 ➔ xmlhttprequest-ssl@1.5.5(vulnerable version)

Since engine.io-client has released a new patched version engine.io-client@3.3.3 to resolve this issue (engine.io-client@3.3.3 ➔ xmlhttprequest-ssl@1.6.3(fix version)), then this vulnerability patch can be automatically propagated into your project only if you update your lockfile. The following is your new dependency path :
@renderforest/sdk-node@0.11.2 ➔ socket.io-client@2.2.0 ➔ engine.io-client@3.3.3 ➔ xmlhttprequest-ssl@1.6.3(vulnerability fix version).

dependency path

A warm tip.
Best regards,
^_^

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions