Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

deps: upgrade engine.io and socket.io-parser #12556

Merged
merged 1 commit into from
May 25, 2023
Merged

deps: upgrade engine.io and socket.io-parser #12556

merged 1 commit into from
May 25, 2023

Conversation

vince-fugnitto
Copy link
Member

@vince-fugnitto vince-fugnitto commented May 24, 2023 •
edited
Loading

What it does

Closes: #12484.

The pull-request resolves known vulnerabilities present in engine.io and socket.io-parser.
The changes are simplified from #12484 in order to have a higher chance of vulnerabilities being approved in a timely manner.

Review:

How to test

  • confirm that CI successfully passes
  • confirm that yarn audit passes:
$ yarn audit
yarn audit v1.22.19
0 vulnerabilities found - Packages audited: 1913
Done in 0.93s.

Review checklist

Reminder for reviewers

@vince-fugnitto
deps: upgrade engine.io and socket.io-parser
938b824 
The commit resolves known vulnerablities in both `engine.io` and
`socket.io-parser`.

Signed-off-by: vince-fugnitto <vincent.fugnitto@ericsson.com>
@vince-fugnitto vince-fugnitto added security issues related to security dependencies pull requests that update a dependency file labels May 24, 2023
@vince-fugnitto vince-fugnitto self-assigned this May 24, 2023
@vince-fugnitto
Copy link
Member Author

The outstanding review for the dependency was approved 👍

msujew
msujew approved these changes May 25, 2023
View reviewed changes
Copy link
Member

@msujew msujew left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

marcdumais-work
marcdumais-work approved these changes May 25, 2023
View reviewed changes
Copy link
Contributor

@marcdumais-work marcdumais-work left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - thanks Vince!

@vince-fugnitto vince-fugnitto merged commit 1c52534 into master May 25, 2023
@vince-fugnitto vince-fugnitto deleted the vf/socket-bump branch May 25, 2023 12:55
@github-actions github-actions bot added this to the 1.38.0 milestone May 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marcdumais-work marcdumais-work marcdumais-work approved these changes

@msujew msujew msujew approved these changes

Assignees

@vince-fugnitto vince-fugnitto

Labels
dependencies pull requests that update a dependency file security issues related to security
Projects
None yet
Milestone
1.38.0
Development

Successfully merging this pull request may close these issues.
3 participants
@vince-fugnitto @msujew @marcdumais-work