security: vulnerability reported in [email protected]

[vince-fugnitto]

Describe the bug

There is a security vulnerability reported in [email protected] which socket.io declares in it's dependencies:

socket.io/package.json

Line 52 in 3d44aae

"engine.io": "~6.4.1",

npm audit output:

$ npm audit
# npm audit report

cookiejar  <2.1.4
Severity: moderate
cookiejar Regular Expression Denial of Service via Cookie.parse function - https:/advisories/GHSA-h452-7996-h45h
fix available via `npm audit fix`
node_modules/cookiejar

engine.io  5.1.0 - 6.4.1
Severity: high
engine.io Uncaught Exception vulnerability - https:/advisories/GHSA-q9mw-68c2-j6m5
fix available via `npm audit fix`
node_modules/engine.io

2 vulnerabilities (1 moderate, 1 high)

To address all issues, run:
  npm audit fix

To Reproduce

1. clone the repository
2. perform npm audit

[darrachequesne]

This should be fixed by 12b0de4. Thanks for the heads-up 👍

[vince-fugnitto]

@darrachequesne thanks for the quick fix! When can we expect a new release?