From 771e5a340e1de2fa2c902a03f715cd62e23a120c Mon Sep 17 00:00:00 2001 From: danielle korn Date: Sun, 6 Sep 2026 10:56:46 +0300 Subject: [PATCH] fix(deps): bump socket.io-parser to 4.2.7 to clear GHSA-2m8v-j782-fhvr The Security Audit workflow has failed on main since 2026-09-01. Two things were stacked: npm's quick audit endpoint is being retired and returns 400 in CI, which masked the fact that the audit legitimately fails underneath. socket.io-parser 4.2.6 carries a high-severity memory exhaustion advisory (GHSA-2m8v-j782-fhvr, range 4.0.0 - 4.2.6). It reaches us through socket.io-client, which is a production dependency, so npm audit --omit=dev does not skip it and the gating step exits 1. socket.io-client 4.8.3 declares socket.io-parser ~4.2.4, so 4.2.7 is already in range. This refreshes the lockfile entry only. No package.json change, no version range change, no major bump. The tarball integrity was verified independently by hashing it rather than trusting the registry response, and the resolved URL is normalised to registry.npmjs.org so all 393 entries stay on one host. npm audit --omit=dev --audit-level=high now reports 0 vulnerabilities and exits 0. --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 001946f4..ad49c10f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4951,9 +4951,9 @@ } }, "node_modules/socket.io-parser": { - "version": "4.2.6", - "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz", - "integrity": "sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==", + "version": "4.2.7", + "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.7.tgz", + "integrity": "sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==", "license": "MIT", "dependencies": { "@socket.io/component-emitter": "~3.1.0",