@microsoft/signalr@10.0.0 has vulnerable package ws@7.5.11 - needs upgrade to 8.21.1
Open
Beginner friendly
area-signalr
feature-client-javascript
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
Allocation of Resources Without Limits or Throttling issue identified in WS 7.5.11 and addressed in recent update to 8.21.1. Dependencies for signalR need updating to rectify
### Expected Behavior
_No response_
### Steps To Reproduce
_No response_
### Exceptions (if any)
_No response_
### .NET Version
_No response_
### Anything else?
_No response_
Contributor guide
Research direction
Start by locating the dependency manifest for @microsoft/signalr@10.0.0 and checking how ws@7.5.11 is resolved. Update the dependency to ws@8.21.1, then run the relevant SignalR package tests or dependency checks and confirm no vulnerable ws version remains.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100