[Snyk] Upgrade socket.io from 4.4.0 to 4.7.3

[chr0m1ng]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade socket.io from 4.4.0 to 4.7.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 14 versions ahead of your current version.
• The recommended version was released a month ago, on 2024-01-03.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Uncaught Exception SNYK-JS-ENGINEIO-2336356	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
	Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
	Uncaught Exception SNYK-JS-ENGINEIO-5496331	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

• 4.7.3 - 2024-01-03
  

  Bug Fixes

  • return the first response when broadcasting to a single socket (#4878) (df8e70f)
  • typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)

  Links

  • Diff: 4.7.2...4.7.3
  • Client release: 4.7.3
  • engine.io@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.2 - 2023-08-02
  

  Bug Fixes

  • clean up child namespace when client is rejected in middleware (#4773) (0731c0d)
  • webtransport: properly handle WebTransport-only connections (3468a19)
  • webtransport: add proper framing (a306db0)

  Links

  • Diff: 4.7.1...4.7.2
  • Client release: 4.7.2
  • engine.io@~6.5.2 (diff)
  • ws@~8.11.0 (no change)
• 4.7.1 - 2023-06-28
  

  The client bundle contains a few fixes regarding the WebTransport support.

  Links

  • Diff: 4.7.0...4.7.1
  • Client release: 4.7.1
  • engine.io@~6.5.0 (no change)
  • ws@~8.11.0 (no change)
• 4.7.0 - 2023-06-22
  

  Bug Fixes

  • remove the Partial modifier from the socket.data type (#4740) (e5c62ca)

  Features

  Support for WebTransport

  The Socket.IO server can now use WebTransport as the underlying transport.

  WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

  References:

  • https://w3c.github.io/webtransport/
  • https://developer.mozilla.org/en-US/docs/Web/API/WebTransport
  • https://developer.chrome.com/articles/webtransport/

  Until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

  https://w3c.github.io/webtransport/#custom-certificate-requirements)
  const cert = readFileSync("/path/to/my/cert.pem");
  const key = readFileSync("/path/to/my/key.pem");

  const httpsServer = createServer({
  key,
  cert
  });

  httpsServer.listen(3000);

  const io = new Server(httpsServer, {
  transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
  });

  const h3Server = new Http3Server({
  port: 3000,
  host: "0.0.0.0",
  secret: "changeit",
  cert,
  privKey: key,
  });

  (async () => {
  const stream = await h3Server.sessionStream("/socket.io/");
  const sessionReader = stream.getReader();

  while (true) {
  const { done, value } = await sessionReader.read();
  if (done) {
  break;
  }
  io.engine.onWebTransportSession(value);
  }
  })();

  h3Server.startServer();">

  import { readFileSync } from "fs";
  
  import { createServer } from "https";
  
  import { Server } from "socket.io";
  
  import { Http3Server } from "@ fails-components/webtransport";
  
  // WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)
  
  const cert = readFileSync("/path/to/my/cert.pem");
  
  const key = readFileSync("/path/to/my/key.pem");
  const httpsServer = createServer({
  
  key,
  
  cert
  
  });
  httpsServer.listen(3000);
  const io = new Server(httpsServer, {
  
  transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
  
  });
  const h3Server = new Http3Server({
  
  port: 3000,
  
  host: "0.0.0.0",
  
  secret: "changeit",
  
  cert,
  
  privKey: key,
  
  });
  (async () => {
  
  const stream = await h3Server.sessionStream("/socket.io/");
  
  const sessionReader = stream.getReader();
  while (true) {
  
  const { done, value } = await sessionReader.read();
  
  if (done) {
  
  break;
  
  }
  
  io.engine.onWebTransportSession(value);
  
  }
  
  })();
  h3Server.startServer();

  Added in 123b68c.

  Client bundles with CORS headers

  The bundles will now have the right Access-Control-Allow-xxx headers.

  Added in 63f181c.

  Links

  • Diff: 4.6.2...4.7.0
  • Client release: 4.7.0
  • engine.io@~6.5.0 (diff)
  • ws@~8.11.0 (no change)
• 4.6.2 - 2023-05-31
  

  Bug Fixes

  • exports: move types condition to the top (#4698) (3d44aae)

  Links

  • Diff: 4.6.1...4.6.2
  • Client release: 4.6.2
  • engine.io@~6.4.2 (diff)
  • ws@~8.11.0 (no change)
• 4.6.1 - 2023-02-20
  

  Bug Fixes

  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#4625) (d0b22c6)

  Links

  • Diff: 4.6.0...4.6.1
  • Client release: 4.6.1
  • engine.io@~6.4.1 (diff)
  • ws@~8.11.0 (no change)
• 4.6.0 - 2023-02-07
  Read more
• 4.6.0-alpha1 - 2023-01-25
  

  The RemoteSocket interface, which is returned when the client is
  connected on another Socket.IO server of the cluster, was lacking the
  timeout() method.

  Syntax:

  const sockets = await io.fetchSockets();

  for (const socket of sockets) {
  if (someCondition) {
  socket.timeout(1000).emit("some-event", (err) => {
  if (err) {
  // the client did not acknowledge the event in the given delay
  }
  });
  }
  }

  Related: #4595

• 4.5.4 - 2022-11-22
  

  This release contains a bump of:

  • engine.io in order to fix CVE-2022-41940
  • socket.io-parser in order to fix CVE-2022-2421.

  Links:

  • Diff: 4.5.3...4.5.4
  • Client release: 4.5.4
  • engine.io@~6.2.1 (diff)
  • ws@~8.2.3
• 4.5.3 - 2022-10-15
• 4.5.2 - 2022-09-02
• 4.5.1 - 2022-05-17
• 4.5.0 - 2022-04-23
• 4.4.1 - 2022-01-06
• 4.4.0 - 2021-11-18

from socket.io GitHub release notes

Commit messages

Package name: socket.io

• 0d89319 chore(release): 4.7.3
• df8e70f fix: return the first response when broadcasting to a single socket (#4878)
• 8c9ebc3 fix(typings): allow to bind to a non-secure Http2Server (#4853)
• efb5c21 docs(examples): add Vue client with CRUD example
• 3848280 docs(examples): upgrade basic-crud-application to Angular v17
• 9a2a83f refactor: cleanup after merge
• f6ef267 refactor(typings): improve emit types (#4817)
• 1cdf36b test: build examples in the CI (#3856)
• bbf1fdc docs: add Elephant.IO as PHP client library (#4779)
• b4dc83e docs(examples): add codesandbox configuration
• ccbb4c0 docs: add example with connection state recovery
• d744fda docs: improve example with express-session
• 8259cda docs: use io.engine.use() with express-session
• fd9dd74 docs: use "connection" instead of "connect"
• c332643 chore(release): 4.7.2
• 3468a19 fix(webtransport): properly handle WebTransport-only connections
• 09d4549 chore: bump engine.io to version 6.5.2
• 0731c0d fix: clean up child namespace when client is rejected in middleware (#4773)
• 03046a6 docs: update the list of supported Node.js versions
• 443e447 docs(examples): add example with WebTransport
• 2f6cc2f chore(release): 4.7.1
• 00d8ee5 chore(release): 4.7.0
• 2dd5fa9 ci: add Node.js 20 in the test matrix
• a5dff0a docs(examples): increase httpd ProxyTimeout value (2)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs