chore(deps): update dependency engine.io to >= 6.4.2 [security] - autoclosed

[svc-secops]

This PR contains the following updates:

Package	Change
engine.io	[6.2.1 -> >= 6.4.2](https://renovatebot.com/diffs/npm/engine.io/6.2.1/>= 6.4.2)

GitHub Vulnerability Alerts

CVE-2023-31125

Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

TypeError: Cannot read properties of undefined (reading 'handlesUpgrades')
    at Server.onWebSocket (build/server.js:515:67)

This impacts all the users of the engine.io package, including those who uses depending packages like socket.io.

Patches

A fix has been released today (2023/05/02): 6.4.2

This bug was introduced in version 5.1.0 and included in version 4.1.0 of the socket.io parent package. Older versions are not impacted.

For socket.io users:

Version range	engine.io version	Needs minor update?
socket.io@4.6.x	~6.4.0	npm audit fix should be sufficient
socket.io@4.5.x	~6.2.0	Please upgrade to socket.io@4.6.x
socket.io@4.4.x	~6.1.0	Please upgrade to socket.io@4.6.x
socket.io@4.3.x	~6.0.0	Please upgrade to socket.io@4.6.x
socket.io@4.2.x	~5.2.0	Please upgrade to socket.io@4.6.x
socket.io@4.1.x	~5.1.1	Please upgrade to socket.io@4.6.x
socket.io@4.0.x	~5.0.0	Not impacted
socket.io@3.1.x	~4.1.0	Not impacted
socket.io@3.0.x	~4.0.0	Not impacted
socket.io@2.5.0	~3.6.0	Not impacted
socket.io@2.4.x and below	~3.5.0	Not impacted

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open an issue in engine.io

Thanks to Thomas Rinsma from Codean for the responsible disclosure.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - "after 8am and before 4pm on tuesday" in timezone Etc/UTC.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

This PR has been generated by Renovate Bot.

[svc-secops]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: docs@undefined
npm ERR! Found: react@17.0.2
npm ERR! node_modules/react
npm ERR!   react@"^17.0.2" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@"^18.0.0 || ^0.0.0" from gatsby@5.10.0
npm ERR! node_modules/gatsby
npm ERR!   gatsby@"5.10.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate/cache/others/npm/_logs/2024-05-09T12_35_52_773Z-debug-0.log

[netlify]

❌ Deploy Preview for apollo-monodocs failed.

Name	Link
🔨 Latest commit	4dd3e13
🔍 Latest deploy log	https://app.netlify.com/sites/apollo-monodocs/deploys/6676b0590e72b90008d72eb8

[svc-secops]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: docs@undefined
npm ERR! Found: react@17.0.2
npm ERR! node_modules/react
npm ERR!   react@"^17.0.2" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@"^18.0.0 || ^0.0.0" from gatsby@5.10.0
npm ERR! node_modules/gatsby
npm ERR!   gatsby@"5.10.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate/cache/others/npm/_logs/2024-06-22T11_06_56_389Z-debug-0.log