[Snyk] Upgrade socket.io from 4.4.1 to 4.8.0 #2

ayushigoyal2840 · 2024-10-15T02:10:10Z

Snyk has created this PR to upgrade socket.io from 4.4.1 to 4.8.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 16 versions ahead of your current version.
The recommended version was released 24 days ago, on 2024-09-21.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Uncaught Exception SNYK-JS-ENGINEIO-5496331	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Uncaught Exception SNYK-JS-SOCKETIO-7278048	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JS-WS-7266574	589/1000 Why? Has a fix available, CVSS 7.5	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

4.8.0 - 2024-09-21

Features

Custom transport implementations

The transports option now accepts an array of transport implementations:

import { io } from "socket.io-client";
import { XHR, WebSocket } from "engine.io-client";

const socket = io({
transports: [XHR, WebSocket]
});

Here is the list of provided implementations:

Transport	Description
`Fetch`	HTTP long-polling based on the built-in `fetch()` method.
`NodeXHR`	HTTP long-polling based on the `XMLHttpRequest` object provided by the `xmlhttprequest-ssl` package.
`XHR`	HTTP long-polling based on the built-in `XMLHttpRequest` object.
`NodeWebSocket`	WebSocket transport based on the `WebSocket` object provided by the `ws` package.
`WebSocket`	WebSocket transport based on the built-in `WebSocket` object.
`WebTransport`	WebTransport transport based on the built-in `WebTransport` object.

Usage:

Transport	browser	Node.js	Deno	Bun
`Fetch`	✅	✅ (1)	✅	✅
`NodeXHR`		✅	✅	✅
`XHR`	✅
`NodeWebSocket`		✅	✅	✅
`WebSocket`	✅	✅ (2)	✅	✅
`WebTransport`	✅	✅

(1) since v18.0.0
(2) since v21.0.0

Added in f4d898e and b11763b.

Test each low-level transports

When setting the tryAllTransports option to true, if the first transport (usually, HTTP long-polling) fails, then the other transports will be tested too:

import { io } from "socket.io-client";

const socket = io({
tryAllTransports: true
});

This feature is useful in two cases:

when HTTP long-polling is disabled on the server, or if CORS fails
when WebSocket is tested first (with transports: ["websocket", "polling"])

The only potential downside is that the connection attempt could take more time in case of failure, as there have been reports of WebSocket connection errors taking several seconds before being detected (that's one reason for using HTTP long-polling first). That's why the option defaults to false for now.

Added in 579b243.