Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update sockjs as it presents a vulnerability or allow for it to update #2940

Closed
2 of 3 tasks
rjherrera opened this issue Dec 24, 2020 · 2 comments
Closed
2 of 3 tasks

Comments

@rjherrera
Copy link

  • Operating System: N/A
  • Node Version: N/A
  • NPM Version: N/A
  • webpack Version: N/A
  • webpack-dev-server Version: 3.11.0
  • Browser: N/A
  • This is a bug
  • This is a modification request
  • This is a dependency update request

There is a vulnerability in sockjs and webpack-dev-server 3.11.0 uses it as a dependency as shown in the package.json#L62. The thing is, it's included with an explicit version (no caret or anything), and therefore it is locked to that specific version, not allowing for patch updates.

As sockjs presents a vulnerability in one of its dependencies, this is a problem affecting webpack-dev-server. The issue has been addressed in sockjs/sockjs-node#275, so I think either allowing for patch updates with ^0.3.20 or explicitly updating to 0.3.21 would address this issue.

Thanks! I'd be glad to submit a pull request if this is the correct approach!

@alexander-akait
Copy link
Member

Fixed, release will be in near future

@rjherrera
Copy link
Author

awesome, thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants