Hi, @ArtyomHov , I have reported a vulnerability issue in package engine.io-client .
As far as I am aware, vulnerability(high severity) CVE-2021-31597 and CVE-2020-28502 detected in package xmlhttprequest-ssl<1.6.1 is directly referenced by [email protected] , on which your package @renderforest/[email protected] transitively depends. As such, this vulnerability can also affect @renderforest/[email protected] via the following path:
@renderforest/[email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected] (vulnerable version)
Since engine.io-client has released a new patched version [email protected] to resolve this issue ([email protected] ➔ [email protected] (fix version) ), then this vulnerability patch can be automatically propagated into your project only if you update your lockfile . The following is your new dependency path :
@renderforest/[email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected] (vulnerability fix version).
A warm tip.
Best regards,
^_^
❤️ React with ❤️ 1elysegrubb01