From 2603b056c0e781cd82bc1f487604d982b57928f7 Mon Sep 17 00:00:00 2001 From: harshit-exe-dev Date: Tue, 13 Oct 2026 21:38:52 +0530 Subject: [PATCH] chore: raise engine.io minimum to ~6.6.10 for published security fixes GHSA-2gc4-cqfq-p2gv affects engine.io >=6.6.0 <6.6.10; the 6.6.10 release also covers GHSA-gr94-w7qr-f4j3 and GHSA-r635-g3xr-vw7x (patched in 6.6.7). Raise the floor from ~6.6.0 to ~6.6.10 so the affected releases are excluded from the allowed range, staying on the existing 6.6 line. Applied to both runtime packages declaring the floor: socket.io and socket.io-cluster-engine. Closes #5571 Signed-off-by: harshit-exe-dev --- packages/socket.io-cluster-engine/package.json | 2 +- packages/socket.io/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/socket.io-cluster-engine/package.json b/packages/socket.io-cluster-engine/package.json index 32c3ed4a1..e49b25fb8 100644 --- a/packages/socket.io-cluster-engine/package.json +++ b/packages/socket.io-cluster-engine/package.json @@ -20,7 +20,7 @@ "dependencies": { "@msgpack/msgpack": "~2.8.0", "debug": "~4.4.1", - "engine.io": "~6.6.0", + "engine.io": "~6.6.10", "engine.io-parser": "~5.2.3" }, "scripts": { diff --git a/packages/socket.io/package.json b/packages/socket.io/package.json index 706508597..0b5b5e05f 100644 --- a/packages/socket.io/package.json +++ b/packages/socket.io/package.json @@ -56,7 +56,7 @@ "accepts": "~1.3.4", "cors": "~2.8.5", "debug": "~4.4.1", - "engine.io": "~6.6.0", + "engine.io": "~6.6.10", "socket.io-adapter": "~2.5.2", "socket.io-parser": "~4.2.4" },