[Snyk] Upgrade socket.io from 4.4.1 to 4.6.1

[sahasprajapati]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade socket.io from 4.4.1 to 4.6.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 8 versions ahead of your current version.
• The recommended version was released 25 days ago, on 2023-02-20.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
	Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

• 4.6.1 - 2023-02-20
  

  Bug Fixes

  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#4625) (d0b22c6)

  Links

  • Diff: 4.6.0...4.6.1
  • Client release: 4.6.1
  • engine.io@~6.4.1 (diff)
  • ws@~8.11.0 (no change)
• 4.6.0 - 2023-02-07
  

  Bug Fixes

  • add timeout method to remote socket (#4558) (0c0eb00)
  • typings: properly type emits with timeout (f3ada7d)

  Features

  Promise-based acknowledgements

  This commit adds some syntactic sugar around acknowledgements:

  • emitWithAck()
  try {
  const responses = await io.timeout(1000).emitWithAck("some-event");
  console.log(responses); // one response per client
  } catch (e) {
  // some clients did not acknowledge the event in the given delay
  }

  io.on("connection", async (socket) => {
  // without timeout
  const response = await socket.emitWithAck("hello", "world");

  // with a specific timeout
  try {
  const response = await socket.timeout(1000).emitWithAck("hello", "world");
  } catch (err) {
  // the client did not acknowledge the event in the given delay
  }
  });

  • serverSideEmitWithAck()

  try {
    const responses = await io.timeout(1000).serverSideEmitWithAck("some-event");
    console.log(responses); // one response per server (except itself)
  } catch (e) {
    // some servers did not acknowledge the event in the given delay
  }

  Added in 184f3cf.

  Connection state recovery

  This feature allows a client to reconnect after a temporary disconnection and restore its state:

  • id
  • rooms
  • data
  • missed packets

  Usage:

  import { Server } from "socket.io";

  const io = new Server({
  connectionStateRecovery: {
  // default values
  maxDisconnectionDuration: 2 60 1000,
  skipMiddlewares: true,
  },
  });

  io.on("connection", (socket) => {
  console.log(socket.recovered); // whether the state was recovered or not
  });

  Here's how it works:

  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state

  The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.

  Added in 54d5ee0.

  Compatibility (for real) with Express middlewares

  This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.

  Syntax:

  io.engine.use((req, res, next) => {
  // do something

  next();
  });

  // with express-session
  import session from "express-session";

  io.engine.use(session({
  secret: "keyboard cat",
  resave: false,
  saveUninitialized: true,
  cookie: { secure: true }
  }));

  // with helmet
  import helmet from "helmet";

  io.engine.use(helmet());

  A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.

  Added in 24786e7.

  Error details in the disconnecting and disconnect events

  The disconnect event will now contain additional details about the disconnection reason.

  io.on("connection", (socket) => {
    socket.on("disconnect", (reason, description) => {
      console.log(description);
    });
  });

  Added in 8aa9499.

  Automatic removal of empty child namespaces

  This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.

  import { createServer } from "node:http";
  import { Server } from "socket.io";

  const httpServer = createServer();
  const io = new Server(httpServer, {
  cleanupEmptyChildNamespaces: true
  });

  Added in 5d9220b.

  A new "addTrailingSlash" option

  The trailing slash which was added by default can now be disabled:

  import { createServer } from "node:http";
  import { Server } from "socket.io";

  const httpServer = createServer();
  const io = new Server(httpServer, {
  addTrailingSlash: false
  });

  In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.

  Added in d0fd474.

  Performance Improvements

  • precompute the WebSocket frames when broadcasting (da2b542)

  Links:

  • Diff: 4.5.4...4.6.0
  • Client release: 4.6.0
  • engine.io@~6.4.0 (diff)
  • ws@~8.11.0 (diff)
• 4.6.0-alpha1 - 2023-01-25
  

  The RemoteSocket interface, which is returned when the client is
  connected on another Socket.IO server of the cluster, was lacking the
  timeout() method.

  Syntax:

  const sockets = await io.fetchSockets();

  for (const socket of sockets) {
  if (someCondition) {
  socket.timeout(1000).emit("some-event", (err) => {
  if (err) {
  // the client did not acknowledge the event in the given delay
  }
  });
  }
  }

  Related: #4595

• 4.5.4 - 2022-11-22
  

  This release contains a bump of:

  • engine.io in order to fix CVE-2022-41940
  • socket.io-parser in order to fix CVE-2022-2421.

  Links:

  • Diff: 4.5.3...4.5.4
  • Client release: 4.5.4
  • engine.io@~6.2.1 (diff)
  • ws@~8.2.3
• 4.5.3 - 2022-10-15
  Read more
• 4.5.2 - 2022-09-02
  Read more
• 4.5.1 - 2022-05-17
  Read more
• 4.5.0 - 2022-04-23
  Read more
• 4.4.1 - 2022-01-06
  Read more

from socket.io GitHub release notes

Commit messages

Package name: socket.io

• 7952312 chore(release): 4.6.1
• 0d0a7a2 fix: properly handle manually created dynamic namespaces
• 2a8565f refactor: catch errors when trying to restore the connection state
• d0b22c6 fix(types): fix nodenext module resolution compatibility (#4625)
• e71f3d7 docs: minor style fix (#4619)
• a2e5d1f chore(release): 4.6.0
• d8143cc refactor: do not persist session if connection state recovery if disabled
• b2dd7cf chore: bump engine.io to version 6.4.0
• 3734b74 revert: feat: expose current offset to allow deduplication
• 8aa9499 feat: add description to the disconnecting and disconnect events (#4622)
• 4e64123 feat: expose current offset to allow deduplication
• 115a981 refactor: do not include the pid by default
• 0c0eb00 fix: add timeout method to remote socket (#4558)
• f8640d9 refactor: export DisconnectReason type
• 93d446a refactor: add charset when serving the bundle files
• 184f3cf feat: add promise-based acknowledgements
• 5d9220b feat: add the ability to clean up empty child namespaces (#4602)
• 1298839 test: add test with onAnyOutgoing() and binary attachments
• 6c27b8b test: add test with socket.disconnect(true)
• f3ada7d fix(typings): properly type emits with timeout
• a21ad88 docs(changelog): add note about maxHttpBufferSize default value (#4596)
• 54d5ee0 feat: implement connection state recovery
• da2b542 perf: precompute the WebSocket frames when broadcasting
• b7d54db docs: add Rust client implementation (#4592)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs