Skip to content

Raise Engine.IO minimum to 6.6.10 for published security fixes #5571

Open

Description

@rafadlis

socket.io@4.8.4 declares engine.io: ~6.6.0. The current source manifest has the same floor.

GHSA-2gc4-cqfq-p2gv affects Engine.IO >=6.6.0 <6.6.10. The published 6.6.10 release also covers GHSA-gr94-w7qr-f4j3 and GHSA-r635-g3xr-vw7x, which were patched in 6.6.7.

Please raise the runtime dependency minimum to ~6.6.10. This stays on the existing 6.6 release line.

The current range already permits patched releases. Raising the floor would exclude affected releases from the allowed range; existing consumer lockfiles would still need to be refreshed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions