[Snyk] Upgrade socket.io-client from 4.5.3 to 4.7.5 #1

Mohsen-mhm · 2024-09-03T05:57:20Z

Snyk has created this PR to upgrade socket.io-client from 4.5.3 to 4.7.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 12 versions ahead of your current version.
The recommended version was released on 6 months ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Denial of Service (DoS) SNYK-JS-WS-7266574	482	Proof of Concept
Denial of Service (DoS) SNYK-JS-WS-7266574	482	Proof of Concept
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	482	No Known Exploit

Release notes

Package name: socket.io-client

4.7.5 - 2024-03-14
Bug Fixes
- discard acknowledgements upon disconnection (34cbfbb)
Links
- Diff: 4.7.4...4.7.5
- Server release: 4.7.5
- engine.io-client@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.4 - 2024-01-12
There were some minor bug fixes on the server side, which mandate a client bump.

Links
- Diff: 4.7.3...4.7.4
- Server release: 4.7.4
- engine.io-client@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.3 - 2024-01-03
Bug Fixes
- improve compatibility with node16 module resolution (#1595) (605de78)
- typings: accept string | undefined as init argument (5a3eafe)
- typings: fix the type of the socket#id attribute (f9c16f2)
Links
- Diff: 4.7.2...4.7.3
- Server release: 4.7.3
- engine.io-client@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.2 - 2023-08-02
Some bug fixes are included from the engine.io-client package:
- webtransport: add proper framing (d55c39e)
- webtransport: honor the binaryType attribute (8270e00)
Links
- Diff: 4.7.1...4.7.2
- Server release: 4.7.2
- engine.io-client@~6.5.2 (diff)
- ws@~8.11.0 (no change)
4.7.1 - 2023-06-28
Some bug fixes are included from the engine.io-client package:
- make closeOnBeforeunload default to false (a63066b)
- webtransport: properly handle abruptly closed connections (cf6aa1f)
Links
- Diff: 4.7.0...4.7.1
- Server release: 4.7.1
- engine.io-client@~6.5.1 (diff)
- ws@~8.11.0 (no change)
4.7.0 - 2023-06-22
Bug Fixes
- properly report timeout error when connecting (5bc94b5)
- use same scope for setTimeout and clearTimeout calls (#1568) (f2892ab)
Features

Support for WebTransport

The Engine.IO client can now use WebTransport as the underlying transport.

WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

References:
For Node.js clients: until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

import { WebTransport } from "@ fails-components/webtransport";

global.WebTransport = WebTransport;

Added in 7195c0f.

Cookie management for the Node.js client

When setting the withCredentials option to true, the Node.js client will now include the cookies in the HTTP requests, making it easier to use it with cookie-based sticky sessions.
https://example.com", {
withCredentials: true
});">
```
import { io } from "socket.io-client";
const socket = io("https://example.com", {

withCredentials: true

});
```
Added in 5fc88a6.

Conditional import of the ESM build with debug logs

By default, the ESM build does not include the debug package in the browser environments, because it increases the bundle size (see 16b6569).

Which means that, unfortunately, debug logs are not available in the devtools console, even when setting the localStorage.debug = ... attribute.

You can now import the build which includes the debug packages with a conditional import. Example with vite:

import { defineConfig } from 'vite'
import react from '@ vitejs/plugin-react'

export default defineConfig({
plugins: [react()],
server: {
port: 4000
},
resolve: {
conditions: ["development"]
}
})

Reference: https://v2.vitejs.dev/config/#resolve-conditions

Added in 781d753.

Links
- Diff: 4.6.2...4.7.0
- Server release: 4.7.0
- engine.io-client version: ~6.5.0 (diff)
- ws version: ~8.11.0 (no change)
4.6.2 - 2023-05-31
Bug Fixes
- exports: move types condition to the top (#1580) (7ead241)
Links
- Diff: 4.6.1...4.6.2
- Server release: 4.6.2
- engine.io-client version: ~6.4.0 (no change)
- ws version: ~8.11.0 (no change)
4.6.1 - 2023-02-20
Bug Fixes
- do not drain the queue while the socket is offline (4996f9e)
- prevent duplicate connections when multiplexing (46213a6)
Links
- Diff: 4.6.0...4.6.1
- Server release: 4.6.1
- engine.io-client version: ~6.4.0 (no change)
- ws version: ~8.11.0 (no change)

4.6.0 - 2023-02-06

Bug Fixes

typings: do not expose browser-specific types (4d6d95e)
ensure manager.socket() returns an active socket (b7dd891)
typings: properly type emits with timeout (#1570) (33e4172)

Features

A new "addTrailingSlash" option

The trailing slash which was added by default can now be disabled:

https://example.com", {
addTrailingSlash: false
});">

import { io } from "socket.io-client";
const socket = io("https://example.com", {

addTrailingSlash: false

});

In the example above, the request URL will be https://example.com/socket.io instead of https://example.com/socket.io/.

Added in 21a6e12.

Promise-based acknowledgements

This commit adds some syntactic sugar around acknowledgements:

// without timeout
const response = await socket.emitWithAck("hello", "world");

// with a specific timeout
try {
const response = await socket.timeout(1000).emitWithAck("hello", "world");
} catch (err) {
// the server did not acknowledge the event in the given delay
}

Note: environments that do not support Promises will need to add a polyfill in order to use this feature.

Added in 47b979d.

Connection state recovery

This feature allows a client to reconnect after a temporary disconnection and restore its ID and receive any packets that was missed during the disconnection gap. It must be enabled on the server side.

A new boolean attribute named recovered is added on the socket object:

socket.on("connect", () => {
  console.log(socket.recovered); // whether the recovery was successful
});

Added in 54d5ee0 (server) and b4e20c5 (client).

Retry mechanism

Two new options are available:

retries: the maximum number of retries. Above the limit, the packet will be discarded.
ackTimeout: the default timeout in milliseconds used when waiting for an acknowledgement (not to be mixed up with the already existing timeout option, which is used by the Manager during the connection)

const socket = io({
retries: 3,
ackTimeout: 10000
});

// implicit ack
socket.emit("my-event");

// explicit ack
socket.emit("my-event", (err, val) => { /* ... */ });

// custom timeout (in that case the ackTimeout is optional)
socket.timeout(5000).emit("my-event", (err, val) => { /* ... */ });

In all examples above, "my-event" will be sent up to 4 times (1 + 3), until the server sends an acknowledgement.

Assigning a unique ID to each packet is the duty of the user, in order to allow deduplication on the server side.

Added in 655dce9.

Links

Diff: 4.5.4...4.6.0
Server release: 4.6.0
engine.io-client version: ~6.4.0 (diff)
ws version: ~8.11.0 (diff)

Size of the bundles:

	min	min+gzip
socket.io.min.js	45.8 KB (+ 3.2 KB ⬆️)	14.5 KB (+ 0.9 KB ⬆️)
socket.io.msgpack.min.js	50.7 KB (+ 3.0 KB ⬆️)	15.5 KB (+ 0.9 KB ⬆️)
socket.io.esm.min.js	37.0 KB (+ 2.5 KB ⬆️)	12.3 KB (+ 0.8 KB ⬆️)

4.6.0-alpha2 - 2023-02-04
Related:
4.6.0-alpha1 - 2023-02-03
4.5.4 - 2022-11-22
4.5.3 - 2022-10-15

from socket.io-client GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade socket.io-client from 4.5.3 to 4.7.5. See this package in npm: socket.io-client See this project in Snyk: https://app.snyk.io/org/mohsen-mhm/project/0346d101-013e-4940-bd70-f817525ac205?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade socket.io-client from 4.5.3 to 4.7.5 #1

[Snyk] Upgrade socket.io-client from 4.5.3 to 4.7.5 #1

Mohsen-mhm commented Sep 3, 2024

Bug Fixes

Links

Links

Bug Fixes

Links

Links

Links

Bug Fixes

Features

Support for WebTransport

Cookie management for the Node.js client

Conditional import of the ESM build with debug logs

Links

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Features

A new "addTrailingSlash" option

Promise-based acknowledgements

Connection state recovery

Retry mechanism

Links

[Snyk] Upgrade socket.io-client from 4.5.3 to 4.7.5 #1

Are you sure you want to change the base?

[Snyk] Upgrade socket.io-client from 4.5.3 to 4.7.5 #1

Conversation

Mohsen-mhm commented Sep 3, 2024

Snyk has created this PR to upgrade socket.io-client from 4.5.3 to 4.7.5.

Issues fixed by the recommended upgrade:

Bug Fixes

Links

Links

Bug Fixes

Links

Links

Links

Bug Fixes

Features

Support for WebTransport

Cookie management for the Node.js client

Conditional import of the ESM build with debug logs

Links

Bug Fixes

Links

Bug Fixes

Links

Bug Fixes

Features

A new "addTrailingSlash" option

Promise-based acknowledgements

Connection state recovery

Retry mechanism

Links