[Snyk] Upgrade socket.io from 4.6.2 to 4.7.5

[bcsnyk]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade socket.io from 4.6.2 to 4.7.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.
• The recommended version was released a month ago, on 2024-03-14.

Release notes

Package name: socket.io

• 4.7.5 - 2024-03-14
  

  Bug Fixes

  • close the adapters when the server is closed (bf64870)
  • remove duplicate pipeline when serving bundle (e426f3e)

  Links

  • Diff: 4.7.4...4.7.5
  • Client release: 4.7.5
  • engine.io@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.4 - 2024-01-12
  

  Bug Fixes

  • typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914

  Links

  • Diff: 4.7.3...4.7.4
  • Client release: 4.7.4
  • engine.io@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.3 - 2024-01-03
  

  Bug Fixes

  • return the first response when broadcasting to a single socket (#4878) (df8e70f)
  • typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)

  Links

  • Diff: 4.7.2...4.7.3
  • Client release: 4.7.3
  • engine.io@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.2 - 2023-08-02
  

  Bug Fixes

  • clean up child namespace when client is rejected in middleware (#4773) (0731c0d)
  • webtransport: properly handle WebTransport-only connections (3468a19)
  • webtransport: add proper framing (a306db0)

  Links

  • Diff: 4.7.1...4.7.2
  • Client release: 4.7.2
  • engine.io@~6.5.2 (diff)
  • ws@~8.11.0 (no change)
• 4.7.1 - 2023-06-28
  

  The client bundle contains a few fixes regarding the WebTransport support.

  Links

  • Diff: 4.7.0...4.7.1
  • Client release: 4.7.1
  • engine.io@~6.5.0 (no change)
  • ws@~8.11.0 (no change)
• 4.7.0 - 2023-06-22
  

  Bug Fixes

  • remove the Partial modifier from the socket.data type (#4740) (e5c62ca)

  Features

  Support for WebTransport

  The Socket.IO server can now use WebTransport as the underlying transport.

  WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

  References:

  • https://w3c.github.io/webtransport/
  • https://developer.mozilla.org/en-US/docs/Web/API/WebTransport
  • https://developer.chrome.com/articles/webtransport/

  Until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

  https://w3c.github.io/webtransport/#custom-certificate-requirements)
  const cert = readFileSync("/path/to/my/cert.pem");
  const key = readFileSync("/path/to/my/key.pem");

  const httpsServer = createServer({
  key,
  cert
  });

  httpsServer.listen(3000);

  const io = new Server(httpsServer, {
  transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
  });

  const h3Server = new Http3Server({
  port: 3000,
  host: "0.0.0.0",
  secret: "changeit",
  cert,
  privKey: key,
  });

  (async () => {
  const stream = await h3Server.sessionStream("/socket.io/");
  const sessionReader = stream.getReader();

  while (true) {
  const { done, value } = await sessionReader.read();
  if (done) {
  break;
  }
  io.engine.onWebTransportSession(value);
  }
  })();

  h3Server.startServer();">

  import { readFileSync } from "fs";
  
  import { createServer } from "https";
  
  import { Server } from "socket.io";
  
  import { Http3Server } from "@ fails-components/webtransport";
  
  // WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)
  
  const cert = readFileSync("/path/to/my/cert.pem");
  
  const key = readFileSync("/path/to/my/key.pem");
  const httpsServer = createServer({
  
  key,
  
  cert
  
  });
  httpsServer.listen(3000);
  const io = new Server(httpsServer, {
  
  transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
  
  });
  const h3Server = new Http3Server({
  
  port: 3000,
  
  host: "0.0.0.0",
  
  secret: "changeit",
  
  cert,
  
  privKey: key,
  
  });
  (async () => {
  
  const stream = await h3Server.sessionStream("/socket.io/");
  
  const sessionReader = stream.getReader();
  while (true) {
  
  const { done, value } = await sessionReader.read();
  
  if (done) {
  
  break;
  
  }
  
  io.engine.onWebTransportSession(value);
  
  }
  
  })();
  h3Server.startServer();

  Added in 123b68c.

  Client bundles with CORS headers

  The bundles will now have the right Access-Control-Allow-xxx headers.

  Added in 63f181c.

  Links

  • Diff: 4.6.2...4.7.0
  • Client release: 4.7.0
  • engine.io@~6.5.0 (diff)
  • ws@~8.11.0 (no change)
• 4.6.2 - 2023-05-31
  

  Bug Fixes

  • exports: move types condition to the top (#4698) (3d44aae)

  Links

  • Diff: 4.6.1...4.6.2
  • Client release: 4.6.2
  • engine.io@~6.4.2 (diff)
  • ws@~8.11.0 (no change)

from socket.io GitHub release notes

Commit messages

Package name: socket.io

• 5017681 chore(release): 4.7.5
• bf64870 fix: close the adapters when the server is closed
• 748e18c ci: test with older TypeScript version
• b9ce6a2 refactor: create specific adapter for parent namespaces (#4950)
• 54dabe5 ci: upgrade to actions/checkout@4 and actions/setup-node@4
• e426f3e fix: remove duplicate pipeline when serving bundle
• e36062c docs: update the webtransport example
• 0bbe8ae docs: only execute the passport middleware once
• 914a8bd docs: add example with JWT
• d943c3e docs: update the Passport.js example
• 6ab2509 chore(release): 4.7.4
• d9fb2f6 chore(tests): add a test for noArgs in a namespace
• 2c0a81c chore(tests): fix issues due to client#id type change
• f8d2644 chore(tests): add type defs for expectjs and fix invalid expectations
• 04640d6 chore(tests): indicate a future ts error with version
• cb6d2e0 fix(typings): calling io.emit with no arguments incorrectly errored
• 80b2c34 chore: bump socket.io-client version
• 0d89319 chore(release): 4.7.3
• df8e70f fix: return the first response when broadcasting to a single socket (#4878)
• 8c9ebc3 fix(typings): allow to bind to a non-secure Http2Server (#4853)
• efb5c21 docs(examples): add Vue client with CRUD example
• 3848280 docs(examples): upgrade basic-crud-application to Angular v17
• 9a2a83f refactor: cleanup after merge
• f6ef267 refactor(typings): improve emit types (#4817)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs