upgrade dependencies #307
upgrade dependencies #307
Conversation
Existing version is vulnerable for DoS attacks with high severity. Version number changed to the latest where these are patched. https://nodesecurity.io/advisories/550 https://nodesecurity.io/advisories/120
to avoid security vulnerabilities
| "xmldom": "^0.1.19", | ||
| "cbor-js": "^0.1.0", | ||
| "socket.io": "1.4.8" | ||
| "socket.io": "2.2.0" |
There was a problem hiding this comment.
Travis fails due to old nodejs 4.2.6 on the build/test image that doesn't support ES6 syntax (which socket.io 2.2.0 apparently uses).
|
We need this update. What can I/we do to help make this happen? |
|
I'm currently building a website using roslibjs and preact. When building for release mode, it fails because roslibjs uses an outdated version of socket.io. For now I was able to solve the issue by simply deleting socket.io from roslib/node_modules and replacing it with a newer version, as so: This assumes that you have installed socket.io with: I'm fully aware that it's a bad solution, but while we're waiting for a fix, it's at least something. Anyways, I suggest updating to a newer node version and using babel to transpile to old js code. |
|
In case anyone else is experiencing the same issues as me (i.e. preact), I have devised a somewhat better solution to the problem. Run the following bash command before building: Edit: This does not require you to install a separate socket.io version. |
|
Thanks! |
…otWebTools#307) Co-authored-by: J-Rojas <jrojas@redlinesolutions.co>
to avoid security vulnerabilities