Hi, @ArtyomHov, I have reported a vulnerability issue in package engine.io-client.
As far as I am aware, vulnerability(high severity) CVE-2021-31597 and CVE-2020-28502 detected in package xmlhttprequest-ssl<1.6.1 is directly referenced by engine.io-client@3.3.2, on which your package @renderforest/sdk-node@0.11.2 transitively depends. As such, this vulnerability can also affect @renderforest/sdk-node@0.11.2 via the following path:
@renderforest/sdk-node@0.11.2 ➔ socket.io-client@2.2.0 ➔ engine.io-client@3.3.2 ➔ xmlhttprequest-ssl@1.5.5(vulnerable version)
Since engine.io-client has released a new patched version engine.io-client@3.3.3 to resolve this issue (engine.io-client@3.3.3 ➔ xmlhttprequest-ssl@1.6.3(fix version)), then this vulnerability patch can be automatically propagated into your project only if you update your lockfile. The following is your new dependency path :
@renderforest/sdk-node@0.11.2 ➔ socket.io-client@2.2.0 ➔ engine.io-client@3.3.3 ➔ xmlhttprequest-ssl@1.6.3(vulnerability fix version).

A warm tip.
Best regards,
^_^