-
Notifications
You must be signed in to change notification settings - Fork 637
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade ws package to 5.2.3 #674
Comments
We were in the process of updating our versions in react-native-windows of ws to clear the vulnerability alerts but trying to force this with a yarn resolution breaks web debugging. |
Looks like we need to go through 4 major versions' worth of breaking changes to get to https://github.com/websockets/ws/releases/tag/5.0.0 At a glance, we're affected by at least websockets/ws#1099 in v3.x (here) and websockets/ws@63e275e in v4.x (here). Probably a few other changes as well. |
@motiz88 anything we can do to help bumping ws? As far as I can see the main react-native repo is already on 6.1.4 https://github.com/facebook/react-native/blob/ca440b91000530e0f9d7cbb4109f25cdd9d135a5/package.json#L121 (ps: maybe worth closing this issue and redirect here? #413) |
Summary: # Context #674 >There is a security vulnerability with the current version of ws, that requires it to be upgraded to 5.2.3. # In this diff > At a glance, we're affected by at least websockets/ws#1099 in v3.x (here) and websockets/ws@63e275e in v4.x (here). Probably a few other changes as well. Like motiz88 mentioned in the issue, there's only 2 API changes that needed to be fixed: - `upgradeReq` was removed from the web socket object, the fix being to take the URL from the request param instead - `onError` now correctly passes an `ErrorEvent` instead of an `Error` object Those are the only usages of ws in metro that i've seen Reviewed By: GijsWeterings Differential Revision: D29517185 fbshipit-source-id: bac12e7106f09b88877e2e138472a0d981d55200
Do you want to request a feature or report a bug?
Bug
What is the current behavior?
There is a security vulnerability with the current version of ws, that requires it to be upgraded to 5.2.3.
This is also an issue for any packages in metro that use a ws version before than 5.2.3
If the current behavior is a bug, please provide the steps to reproduce and a minimal repository on GitHub that we can
yarn install
andyarn test
.Please see: GHSA-6fc8-4gx4-v693
What is the expected behavior?
No security vulnerability
Please provide your exact Metro configuration and mention your Metro, node, yarn/npm version and operating system.
The text was updated successfully, but these errors were encountered: