OkHttp vulnerability issues in Socket.io client dependency

[shivamsharma2710]

Socket.IO Library has two vulnerabilities which are coming out from the internal OkHttp dependency. I've used the latest socket.io v2.1.0 which is using very old version 3.12.12 of OkHttp.

Following are the vulnerabilities:

1. Improper Certificate Validation

2. Information Exposure

Please give an estimate on when you're planning to fix these vulnerabilities?

PFA the complete vulnerability report,

[shivamsharma2710]

@darrachequesne Please give an ETA when will be new release coming out with this fix?

[nibexo]

Almost 2 years pass, and vulnerable packages are still in SocketIO 😢

[shivamsharma2710]

@darrachequesne What key actions are we considering to take this year?