Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Breaking changes on security update for socket.io-parser #196

Open
Jorge644240 opened this issue Nov 1, 2022 · 0 comments
Open

Breaking changes on security update for socket.io-parser #196

Jorge644240 opened this issue Nov 1, 2022 · 0 comments

Comments

@Jorge644240
Copy link

In a recent git push, both GitHub and npm said there was an issue with express-status-monitor coming out of a vulnerability in socket.io-parser, as shown below.
image

When I ran npm audit fix, npm updated the socket.io-parser version to 4.0.5. This fixed the previous issue, but when running my app again, I noticed that the express-status-monitor page didn't work.
image
So I tried uninstalling the package and installing it again, and it works, but then it brings back the vulnerable version of socket.io-parser.

This might be a better question for the socket.io team, but is there a change from version 3.4.x to version 4.0.5 that makes express-status-monitor not work?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant