Skip to content

Commit

Permalink
security: socket.io-parser resolution docs
Browse files Browse the repository at this point in the history
The commit adds a note regarding the `socket.io-parser` resolution in
our migration guide for downstream adopters.

Signed-off-by: vince-fugnitto <vincent.fugnitto@ericsson.com>
  • Loading branch information
vince-fugnitto committed Nov 1, 2022
1 parent 72fedc0 commit 000988a
Showing 1 changed file with 15 additions and 2 deletions.
17 changes: 15 additions & 2 deletions doc/Migration.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,14 @@ Please see the latest version (`master`) for the most up-to-date information. Pl

### General

Due to a [colors.js](https://github.com/Marak/colors.js) issue, a [resolution](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/) may be necessary for your application in order to workaround the problem:
Prior to [`v1.31.1`](https://github.com/eclipse-theia/theia/releases/tag/v1.31.1), a [resolution](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/) might be necessary to work-around a recently discovered [critical vulnerability](https://security.snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012) in one of our runtime dependencies [socket.io-parser](https://github.com/socketio/socket.io-parser).

For example:

```json
"resolutions": {
"**/colors": "<=1.4.0"
"**/socket.io": "^4.5.3",
"**/socket.io-client": "^4.5.3"
}
```

Expand Down Expand Up @@ -109,6 +110,18 @@ For more details, see the socket.io documentation about [using multiple nodes](h

### v1.22.0

#### Resolutions

Due to a [colors.js](https://github.com/Marak/colors.js) issue, a [resolution](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/) may be necessary for your application in order to workaround the problem:

For example:

```json
"resolutions": {
"**/colors": "<=1.4.0"
}
```

#### Electron Update

Electron got updated from 9 to 15, this might involve some modifications in your code based on the new APIs.
Expand Down

0 comments on commit 000988a

Please sign in to comment.