4 high severity vulnerabilities when installing browser-sync #1933

Activity

1. cjfloss commented on Feb 23, 2022

   

   cjfloss

   on Feb 23, 2022

   Last edited by cjfloss

   More actions

   # npm audit report
   
   engine.io  <4.0.0
   Severity: high
   Resource exhaustion in engine.io  - https://github.com/advisories/GHSA-j4f2-536g-r55m
   fix available via `npm audit fix --force`
   Will install browser-sync@0.9.1, which is a breaking change
   node_modules/engine.io
     socket.io  1.0.0-pre - 2.4.1
     Depends on vulnerable versions of engine.io
     node_modules/socket.io
       browser-sync  >=1.0.0
       Depends on vulnerable versions of socket.io
       node_modules/browser-sync
         browser-sync-webpack-plugin  >=0.1.2
         Depends on vulnerable versions of browser-sync
         node_modules/browser-sync-webpack-plugin
   
   4 high severity vulnerabilities
   
2. lachieh commented on Feb 24, 2022

   

   lachieh

   on Feb 24, 2022

   Contributor

   More actions

   Duplicate issue. See #1850 for original.
3. shakyShane

   closed this as completedin #1936on Mar 4, 2022