dependencies: Update dependency engine.io to 6.2.1 [SECURITY] - abandoned

[renovate]

This PR contains the following updates:

Package	Change
engine.io	6.1.0 -> 6.2.1

GitHub Vulnerability Alerts

CVE-2022-21676

Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear
at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14)
at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22)
at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10)
at writeOrBuffer (internal/streams/writable.js:358:12)

This impacts all the users of the engine.io package starting from version 4.0.0, including those who uses depending packages like socket.io.

Patches

A fix has been released for each major branch:

Version range	Fixed version
[email protected]	4.1.2
[email protected]	5.2.1
[email protected]	6.1.1

Previous versions (< 4.0.0) are not impacted.

For socket.io users:

Version range	engine.io version	Needs minor update?
[email protected]	~6.1.0	-
[email protected]	~6.0.0	Please upgrade to [email protected]
[email protected]	~5.2.0	-
[email protected]	~5.1.1	Please upgrade to [email protected]
[email protected]	~5.0.0	Please upgrade to [email protected]
[email protected]	~4.1.0	-
[email protected]	~4.0.0	Please upgrade to [email protected] or [email protected] (see here)

In most cases, running npm audit fix should be sufficient. You can also use npm update engine.io --depth=9999.

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open an issue in engine.io

Thanks to Marcus Wejderot from Mevisio for the responsible disclosure.

CVE-2022-41940

Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

events.js:292
      throw er; // Unhandled 'error' event
      ^

Error: read ECONNRESET
    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  errno: -104,
  code: 'ECONNRESET',
  syscall: 'read'
}

This impacts all the users of the engine.io package, including those who uses depending packages like socket.io.

Patches

A fix has been released today (2022/11/20):

Version range	Fixed version
[email protected]	3.6.1
[email protected]	6.2.1

For socket.io users:

Version range	engine.io version	Needs minor update?
[email protected]	~6.2.0	npm audit fix should be sufficient
[email protected]	~6.1.0	Please upgrade to [email protected]
[email protected]	~6.0.0	Please upgrade to [email protected]
[email protected]	~5.2.0	Please upgrade to [email protected]
[email protected]	~5.1.1	Please upgrade to [email protected]
[email protected]	~5.0.0	Please upgrade to [email protected]
[email protected]	~4.1.0	Please upgrade to [email protected] (see here)
[email protected]	~4.0.0	Please upgrade to [email protected] (see here)
[email protected]	~3.6.0	npm audit fix should be sufficient
[email protected] and below	~3.5.0	Please upgrade to [email protected]

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open an issue in engine.io

Thanks to Jonathan Neve for the responsible disclosure.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.