Update to use latest sockjs-client package, once they've updated to use latest eventsource package (CVE-2022-1650)

[nathanmillar16]

Bug report

webpack-dev-server has sockjs-client as a dependency. sockjs-client has a dependency eventsource. sockjs-client needs to update to latest event soruce. Once that is done, webpack-dev-server will need to update to latest sockjs-client

sockjs-client will need to use eventsource 2.0.2. Lower versions have a critical vulnerability.

Actual Behavior

Vulnerability scanners (with up to date definitions), perform a scan against webpack-dev-server. Notice the failure for eventsource 1.1.0

Expected Behavior

Use a vulnerability scanners (with up to date definitions), it should pass with eventsource, sockjs-client and webpack-dev-server

How Do We Reproduce?

Use a vulnerability scanner (with up to date definitions), perform a scan against webpack-dev-server. Notice the failure for eventsource 1.1.0

[nathanmillar16]

This change is dependant on one of the following PRs:

sockjs/sockjs-client#590

sockjs/sockjs-client#591

[ahmetalsan]

I have same error. Please help

[nathanmillar16]

Related Vulnerability defition:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1650
https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e/

[alexander-akait]

We should wait the fix in sockjs-client, we can't fix it here

[nathanmillar16]

We should wait the fix in sockjs-client, we can't fix it here

Yes, that's right. I raised this issue so people are aware and stated in original bug comment that it is pending a fix in sockjs

[nathanmillar16]

sockjs-client have now implemented this fix. (sockjs/sockjs-client#590)

webpack-dev-server can now consume the newest version of sockjs-client

[alexander-akait]

Fixed https://github.com/webpack/webpack-dev-server/releases/tag/v4.9.1