max-mapper / max-mapper/websocket-stream
Security vulnerability GHSA-6fc8-4gx4-v693 on ws ^3.2.0 dependency
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 667
- Forks
- 110
- PR merge metrics
- No merged PRs in 30d
Description
Hello, dependabot just warned me on one of my repositories that `"ws": "^3.2.0"` has this security vulnerability: https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
The closest fixed version is `5.2.3`.
Any upgrade path planned for this?
I'm going to try to help as much as I can, but I'm not familiar with the codebase of the project (just arrived here), but if I can be of help, I will do so.
Any comment from maintainers on this?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the `ws` ^3.2.0 dependency declaration and reviewing how the project uses it. Check the upgrade path to the stated fixed version 5.2.3, then run the project's existing checks to confirm the dependency update does not break websocket stream behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100