Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

4 high severity vulnerabilities when installing browser-sync #1933

Closed
stratboy opened this issue Feb 17, 2022 · 2 comments · Fixed by #1936
Closed

4 high severity vulnerabilities when installing browser-sync #1933

stratboy opened this issue Feb 17, 2022 · 2 comments · Fixed by #1936

Comments

@stratboy
Copy link

stratboy commented Feb 17, 2022 •
edited
Loading

Issue details

4 high severity vulnerabilities

Steps to reproduce/test case

just npm install browser-sync: you'll get that warning
@cjfloss
Copy link

cjfloss commented Feb 23, 2022 •
edited
Loading 

# npm audit report

engine.io  <4.0.0
Severity: high
Resource exhaustion in engine.io  - https://github.com/advisories/GHSA-j4f2-536g-r55m
fix available via `npm audit fix --force`
Will install browser-sync@0.9.1, which is a breaking change
node_modules/engine.io
  socket.io  1.0.0-pre - 2.4.1
  Depends on vulnerable versions of engine.io
  node_modules/socket.io
    browser-sync  >=1.0.0
    Depends on vulnerable versions of socket.io
    node_modules/browser-sync
      browser-sync-webpack-plugin  >=0.1.2
      Depends on vulnerable versions of browser-sync
      node_modules/browser-sync-webpack-plugin

4 high severity vulnerabilities

@lachieh
Copy link
Contributor

lachieh commented Feb 24, 2022

Duplicate issue. See #1850 for original.

@lachieh lachieh mentioned this issue Feb 24, 2022
Merged
This was referenced Mar 13, 2022
Merged
Merged
Merged
Merged
Closed
Merged
Open
Merged
Open
Merged
Merged
Merged
Open
Merged
Merged
Open
Merged
Open
Merged
Merged
Merged
Open
Open
Open
Merged
Open
This was referenced Apr 4, 2022
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
This was referenced Apr 18, 2022
Merged
Merged
Merged
Merged
This was referenced Apr 19, 2022
Open
Open
Open
This was referenced Apr 24, 2022
Merged
Open
Open
Open
Open
Open
Merged
@mend-for-github-com mend-for-github-com bot mentioned this issue May 2, 2022
Open
1 task
This was referenced May 2, 2022
Closed
Merged
@renovate renovate bot mentioned this issue Jul 24, 2022
Open
@moul-bot moul-bot mentioned this issue Oct 2, 2022
Closed
This was referenced Oct 31, 2022
Merged
Merged
@q1blue q1blue mentioned this issue Feb 7, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Upgrade to latest version of socket.io due to security vulnerability
3 participants
@stratboy @lachieh @cjfloss