[Snyk] Upgrade socket.io from 4.1.2 to 4.7.5

[karthurian]

Snyk has created this PR to upgrade socket.io from 4.1.2 to 4.7.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 22 versions ahead of your current version.

• The recommended version was released on 4 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Uncaught Exception SNYK-JS-SOCKETIO-7278048	649	No Known Exploit
	Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	649	No Known Exploit
	Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	649	No Known Exploit
	Uncaught Exception SNYK-JS-ENGINEIO-2336356	649	Proof of Concept
	Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	649	No Known Exploit
	Uncaught Exception SNYK-JS-ENGINEIO-5496331	649	No Known Exploit
	Denial of Service (DoS) SNYK-JS-WS-7266574	649	Proof of Concept

Release notes

Package name: socket.io

• 4.7.5 - 2024-03-14
  

  Bug Fixes

  • close the adapters when the server is closed (bf64870)
  • remove duplicate pipeline when serving bundle (e426f3e)

  Links

  • Diff: 4.7.4...4.7.5
  • Client release: 4.7.5
  • engine.io@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.4 - 2024-01-12
  

  Bug Fixes

  • typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914

  Links

  • Diff: 4.7.3...4.7.4
  • Client release: 4.7.4
  • engine.io@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.3 - 2024-01-03
  

  Bug Fixes

  • return the first response when broadcasting to a single socket (#4878) (df8e70f)
  • typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)

  Links

  • Diff: 4.7.2...4.7.3
  • Client release: 4.7.3
  • engine.io@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.2 - 2023-08-02
  

  Bug Fixes

  • clean up child namespace when client is rejected in middleware (#4773) (0731c0d)
  • webtransport: properly handle WebTransport-only connections (3468a19)
  • webtransport: add proper framing (a306db0)

  Links

  • Diff: 4.7.1...4.7.2
  • Client release: 4.7.2
  • engine.io@~6.5.2 (diff)
  • ws@~8.11.0 (no change)
• 4.7.1 - 2023-06-28
  

  The client bundle contains a few fixes regarding the WebTransport support.

  Links

  • Diff: 4.7.0...4.7.1
  • Client release: 4.7.1
  • engine.io@~6.5.0 (no change)
  • ws@~8.11.0 (no change)
• 4.7.0 - 2023-06-22
  

  Bug Fixes

  • remove the Partial modifier from the socket.data type (#4740) (e5c62ca)

  Features

  Support for WebTransport

  The Socket.IO server can now use WebTransport as the underlying transport.

  WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

  References:

  • https://w3c.github.io/webtransport/
  • https://developer.mozilla.org/en-US/docs/Web/API/WebTransport
  • https://developer.chrome.com/articles/webtransport/

  Until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

  https://w3c.github.io/webtransport/#custom-certificate-requirements)
  const cert = readFileSync("/path/to/my/cert.pem");
  const key = readFileSync("/path/to/my/key.pem");

  const httpsServer = createServer({
  key,
  cert
  });

  httpsServer.listen(3000);

  const io = new Server(httpsServer, {
  transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
  });

  const h3Server = new Http3Server({
  port: 3000,
  host: "0.0.0.0",
  secret: "changeit",
  cert,
  privKey: key,
  });

  (async () => {
  const stream = await h3Server.sessionStream("/socket.io/");
  const sessionReader = stream.getReader();

  while (true) {
  const { done, value } = await sessionReader.read();
  if (done) {
  break;
  }
  io.engine.onWebTransportSession(value);
  }
  })();

  h3Server.startServer();">

  import { readFileSync } from "fs";
  
  import { createServer } from "https";
  
  import { Server } from "socket.io";
  
  import { Http3Server } from "@ fails-components/webtransport";
  
  // WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)
  
  const cert = readFileSync("/path/to/my/cert.pem");
  
  const key = readFileSync("/path/to/my/key.pem");
  const httpsServer = createServer({
  
  key,
  
  cert
  
  });
  httpsServer.listen(3000);
  const io = new Server(httpsServer, {
  
  transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
  
  });
  const h3Server = new Http3Server({
  
  port: 3000,
  
  host: "0.0.0.0",
  
  secret: "changeit",
  
  cert,
  
  privKey: key,
  
  });
  (async () => {
  
  const stream = await h3Server.sessionStream("/socket.io/");
  
  const sessionReader = stream.getReader();
  while (true) {
  
  const { done, value } = await sessionReader.read();
  
  if (done) {
  
  break;
  
  }
  
  io.engine.onWebTransportSession(value);
  
  }
  
  })();
  h3Server.startServer();

  Added in 123b68c.

  Client bundles with CORS headers

  The bundles will now have the right Access-Control-Allow-xxx headers.

  Added in 63f181c.

  Links

  • Diff: 4.6.2...4.7.0
  • Client release: 4.7.0
  • engine.io@~6.5.0 (diff)
  • ws@~8.11.0 (no change)
• 4.6.2 - 2023-05-31
  

  Bug Fixes

  • exports: move types condition to the top (#4698) (3d44aae)

  Links

  • Diff: 4.6.1...4.6.2
  • Client release: 4.6.2
  • engine.io@~6.4.2 (diff)
  • ws@~8.11.0 (no change)
• 4.6.1 - 2023-02-20
• 4.6.0 - 2023-02-07
• 4.6.0-alpha1 - 2023-01-25
• 4.5.4 - 2022-11-22
• 4.5.3 - 2022-10-15
• 4.5.2 - 2022-09-02
• 4.5.1 - 2022-05-17
• 4.5.0 - 2022-04-23
• 4.4.1 - 2022-01-06
• 4.4.0 - 2021-11-18
• 4.3.2 - 2021-11-08
• 4.3.1 - 2021-10-16
• 4.3.0 - 2021-10-14
• 4.2.0 - 2021-08-30
• 4.1.3 - 2021-07-10
• 4.1.2 - 2021-05-17

from socket.io GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs