Snyk Vulnerability issue on ioredis@4.31.0

[kemaoaoao]

javascript-client/package.json

Line 43 in 53709e2

"ioredis": "^4.28.0 || ^5.0.0",

Description

New Snyk Vulnerability on ioredis@4.31.0 affecting latest splitio javascript-client

https://security.snyk.io/vuln/SNYK-JS-IOREDIS-19963957

Affected versions

Tested only on @splitsoftware/splitio:11.11.2 (latest as of writing), but could affect older versions as well.

[EmilianoSanchez]

Hi @kemaoaoao ,

We have released @splitsoftware/splitio@11.12.0, which extends the supported ioredis range to include v6 that fixes the vulnerability as stated here: https://security.snyk.io/vuln/SNYK-JS-IOREDIS-19963957

Upgrading the SDK and updating ioredis to v6 should resolve the reported vulnerability.

Be aware that ioredis v6 requires Node.js v20 or above. If you are on an older Node.js version, you should pin ioredis back to v4 or v5.

I will be closing the ticket for now, but feel free to reopen it if necessary.