21.md (8716B)
1 # PR #21 Bump engine.io from 6.2.0 to 6.2.1 2 3 - **Status:** merged 4 - **Author:** @dependabot[bot] 5 - **Created:** 2022-11-22T05:49:11Z 6 - **Branch:** dependabot/npm_and_yarn/engine.io-6.2.1 → master 7 - **Merged:** 2022-11-22T06:04:33Z 8 - **Labels:** dependencies 9 - **Diff:** [21.diff](./21.diff) 10 11 --- 12 13 Bumps [engine.io](https://github.com/socketio/engine.io) from 6.2.0 to 6.2.1. 14 <details> 15 <summary>Release notes</summary> 16 <p><em>Sourced from <a href="https://github.com/socketio/engine.io/releases">engine.io's releases</a>.</em></p> 17 <blockquote> 18 <h2>6.2.1</h2> 19 <p>:warning: This release contains an important security fix :warning:</p> 20 <p>A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:</p> 21 <pre><code>Error: read ECONNRESET 22 at TCP.onStreamRead (internal/stream_base_commons.js:209:20) 23 Emitted 'error' event on Socket instance at: 24 at emitErrorNT (internal/streams/destroy.js:106:8) 25 at emitErrorCloseNT (internal/streams/destroy.js:74:3) 26 at processTicksAndRejections (internal/process/task_queues.js:80:21) { 27 errno: -104, 28 code: 'ECONNRESET', 29 syscall: 'read' 30 } 31 </code></pre> 32 <p>Please upgrade as soon as possible.</p> 33 <h3>Bug Fixes</h3> 34 <ul> 35 <li>catch errors when destroying invalid upgrades (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/658">#658</a>) (<a href="https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6">425e833</a>)</li> 36 </ul> 37 </blockquote> 38 </details> 39 <details> 40 <summary>Changelog</summary> 41 <p><em>Sourced from <a href="https://github.com/socketio/engine.io/blob/main/CHANGELOG.md">engine.io's changelog</a>.</em></p> 42 <blockquote> 43 <h2><a href="https://github.com/socketio/engine.io/compare/6.2.0...6.2.1">6.2.1</a> (2022-11-20)</h2> 44 <p>:warning: This release contains an important security fix :warning:</p> 45 <p>A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:</p> 46 <pre><code>Error: read ECONNRESET 47 at TCP.onStreamRead (internal/stream_base_commons.js:209:20) 48 Emitted 'error' event on Socket instance at: 49 at emitErrorNT (internal/streams/destroy.js:106:8) 50 at emitErrorCloseNT (internal/streams/destroy.js:74:3) 51 at processTicksAndRejections (internal/process/task_queues.js:80:21) { 52 errno: -104, 53 code: 'ECONNRESET', 54 syscall: 'read' 55 } 56 </code></pre> 57 <p>Please upgrade as soon as possible.</p> 58 <h3>Bug Fixes</h3> 59 <ul> 60 <li>catch errors when destroying invalid upgrades (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/658">#658</a>) (<a href="https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6">425e833</a>)</li> 61 </ul> 62 <h1><a href="https://github.com/socketio/engine.io/compare/3.5.0...3.6.0">3.6.0</a> (2022-06-06)</h1> 63 <h3>Bug Fixes</h3> 64 <ul> 65 <li>add extension in the package.json main entry (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/608">#608</a>) (<a href="https://github.com/socketio/engine.io/commit/3ad0567dbd57cfb7c2ff4e8b7488d80f37022b4a">3ad0567</a>)</li> 66 <li>do not reset the ping timer after upgrade (<a href="https://github.com/socketio/engine.io/commit/1f5d4699862afee1e410fcb0e1f5e751ebcd2f9f">1f5d469</a>), closes <a href="https://github-redirect.dependabot.com//github-redirect.dependabot.com/socketio/socket.io-client-swift/pull/1309/issues/issuecomment-768475704">socketio/socket.io-client-swift#1309</a></li> 67 </ul> 68 <h3>Features</h3> 69 <ul> 70 <li>decrease the default value of maxHttpBufferSize (<a href="https://github.com/socketio/engine.io/commit/58e274c437e9cbcf69fd913c813aad8fbd253703">58e274c</a>)</li> 71 </ul> 72 <p>This change reduces the default value from 100 mb to a more sane 1 mb.</p> 73 <p>This helps protect the server against denial of service attacks by malicious clients sending huge amounts of data.</p> 74 <p>See also: <a href="https://github.com/advisories/GHSA-j4f2-536g-r55m">https://github.com/advisories/GHSA-j4f2-536g-r55m</a></p> 75 <ul> 76 <li>increase the default value of pingTimeout (<a href="https://github.com/socketio/engine.io/commit/f55a79a28a5fbc6c9edae876dd11308b89cc979e">f55a79a</a>)</li> 77 </ul> 78 </blockquote> 79 </details> 80 <details> 81 <summary>Commits</summary> 82 <ul> 83 <li><a href="https://github.com/socketio/engine.io/commit/24b847be6a61b64efc8c8c4d058a69259ad67693"><code>24b847b</code></a> chore(release): 6.2.1</li> 84 <li><a href="https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6"><code>425e833</code></a> fix: catch errors when destroying invalid upgrades (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/658">#658</a>)</li> 85 <li><a href="https://github.com/socketio/engine.io/commit/99adb00ba11d80ab27a4a2f4afd0eebd8aa406c5"><code>99adb00</code></a> chore(deps): bump xmlhttprequest-ssl and engine.io-client in /examples/latenc...</li> 86 <li><a href="https://github.com/socketio/engine.io/commit/d196f6a6b746b5e362b131a1a16901a3db12cb21"><code>d196f6a</code></a> chore(deps): bump minimatch from 3.0.4 to 3.1.2 (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/660">#660</a>)</li> 87 <li><a href="https://github.com/socketio/engine.io/commit/7c1270f98c51e51dfae1237492a56276070fd10e"><code>7c1270f</code></a> chore(deps): bump nanoid from 3.1.25 to 3.3.1 (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/659">#659</a>)</li> 88 <li><a href="https://github.com/socketio/engine.io/commit/535a01d8898a5cc858c9d6031fc5ecda96ea4579"><code>535a01d</code></a> ci: add Node.js 18 in the test matrix</li> 89 <li><a href="https://github.com/socketio/engine.io/commit/1b71a6f5cb868c934696ae3cc1a92d1168ec8505"><code>1b71a6f</code></a> docs: remove "Vanilla JS" highlight from README (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/656">#656</a>)</li> 90 <li><a href="https://github.com/socketio/engine.io/commit/917d1d29e13f2e8f523c3738f6413f67b587aebe"><code>917d1d2</code></a> refactor: replace deprecated <code>String.prototype.substr()</code> (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/646">#646</a>)</li> 91 <li><a href="https://github.com/socketio/engine.io/commit/020801ab8ce2d4cba517fe04df89b39d403123a5"><code>020801a</code></a> chore: add changelog for version 3.6.0</li> 92 <li><a href="https://github.com/socketio/engine.io/commit/ed1d6f912ce61b13e2ae7ce7a1027b8c5fae2f15"><code>ed1d6f9</code></a> test: make test script work on Windows (<a href="https://github-redirect.dependabot.com/socketio/engine.io/issues/643">#643</a>)</li> 93 <li>See full diff in <a href="https://github.com/socketio/engine.io/compare/6.2.0...6.2.1">compare view</a></li> 94 </ul> 95 </details> 96 <br /> 97 98 99 [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) 100 101 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. 102 103 [//]: # (dependabot-automerge-start) 104 [//]: # (dependabot-automerge-end) 105 106 --- 107 108 <details> 109 <summary>Dependabot commands and options</summary> 110 <br /> 111 112 You can trigger Dependabot actions by commenting on this PR: 113 - `@dependabot rebase` will rebase this PR 114 - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it 115 - `@dependabot merge` will merge this PR after your CI passes on it 116 - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it 117 - `@dependabot cancel merge` will cancel a previously requested merge and block automerging 118 - `@dependabot reopen` will reopen this PR if it is closed 119 - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually 120 - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) 121 - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) 122 - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) 123 You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Nordgedanken/nordgedanken.github.io/network/alerts). 124 125 </details> 126