bump to engine.io-client 6.6.0?

[Schipy]

Hi, is there a reason engine.io-client is not bumped to 6.6.0? (in socket.io-client). The latest engine.io-client contains bump to "ws": "~8.17.1", which includes the fix for this vulnerability: CVE-2024-37890 (related WS issue)

thanks

[darrachequesne]

Hi!

[email protected] depends on engine.io-client@~6.5.2, which should install [email protected] and thus [email protected]. Isn't that the case for you?

[CsabaSzabo]

@darrachequesne it works only if the [email protected] is manually resolved, otherwise the engine.io-client@~6.5.2 installs [email protected] in our project

  "resolutions": {
    "engine.io-client": "6.5.4"
  }

[darrachequesne]

That's weird, manual resolution should not be needed. Which package manager are you using? npm? The main point of using ~ versions is to prevent this kind of issues.