[Snyk] Upgrade socket.io from 4.7.5 to 4.8.0

[kasinadhsarma]

Snyk has created this PR to upgrade socket.io from 4.7.5 to 4.8.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.
• The recommended version was released 25 days ago, on 2024-09-21.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	44/1000 Why? Confidentiality impact: None, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 9, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 1.86, Score Version: V5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

• 4.8.0 - 2024-09-21
  

  Features

  Custom transport implementations

  The transports option now accepts an array of transport implementations:

  import { io } from "socket.io-client";
  import { XHR, WebSocket } from "engine.io-client";

  const socket = io({
  transports: [XHR, WebSocket]
  });

  Here is the list of provided implementations:

  Transport	Description
  Fetch	HTTP long-polling based on the built-in fetch() method.
  NodeXHR	HTTP long-polling based on the XMLHttpRequest object provided by the xmlhttprequest-ssl package.
  XHR	HTTP long-polling based on the built-in XMLHttpRequest object.
  NodeWebSocket	WebSocket transport based on the WebSocket object provided by the ws package.
  WebSocket	WebSocket transport based on the built-in WebSocket object.
  WebTransport	WebTransport transport based on the built-in WebTransport object.

  Usage:

  Transport	browser	Node.js	Deno	Bun
  Fetch	✅	✅ (1)	✅	✅
  NodeXHR		✅	✅	✅
  XHR	✅
  NodeWebSocket		✅	✅	✅
  WebSocket	✅	✅ (2)	✅	✅
  WebTransport	✅	✅

  (1) since v18.0.0
  (2) since v21.0.0

  Added in f4d898e and b11763b.

  Test each low-level transports

  When setting the tryAllTransports option to true, if the first transport (usually, HTTP long-polling) fails, then the other transports will be tested too:

  import { io } from "socket.io-client";

  const socket = io({
  tryAllTransports: true
  });

  This feature is useful in two cases:

  • when HTTP long-polling is disabled on the server, or if CORS fails
  • when WebSocket is tested first (with transports: ["websocket", "polling"])

  The only potential downside is that the connection attempt could take more time in case of failure, as there have been reports of WebSocket connection errors taking several seconds before being detected (that's one reason for using HTTP long-polling first). That's why the option defaults to false for now.

  Added in 579b243.

  Bug Fixes

  • accept string | undefined as init argument (bis) (60c757f)
  • allow to manually stop the reconnection loop (13c6d2e)
  • close the engine upon decoding exception (04c8dd9)
  • do not send a packet on an expired connection (#5134) (8adcfbf)

  Dependencies

  • engine.io-client@~6.6.1 (diff and diff)
  • ws@~8.17.1 (diff)
• 4.7.5 - 2024-03-14

from socket.io GitHub release notes

Commit messages

Package name: socket.io

• d0fc720 chore(release): socket.io@4.8.0
• 4a0555c chore(release): socket.io-client@4.8.0
• 2b60df1 chore(release): engine.io@6.6.1
• d4cb375 ci: ignore tests when publishing to npm
• c251ae7 chore(release): engine.io-client@6.6.1
• 8a2f5a3 fix(eio-client): move 'offline' event listener at the top
• b04fa64 fix(sio): allow to join a room in a middleware (uws)
• 7085f0e refactor(sio-client): mangle private attributes
• 4f66708 chore(sio-client): use babel loose mode when transpiling classes
• 1a95db2 chore(sio-client): add a script to compute the bundle size
• 282ae92 chore(sio-client): restore the debug package in the dev bundle
• 93010ca chore(eio-client): bump xmlhttprequest-ssl to version 2.1.1
• 132d05f fix(sio): expose type of default engine
• d5095fe fix(eio): prevent the client from upgrading twice (uws)
• da61381 test(eio): bump uWebSockets.js to version 20.48.0
• 19c48a4 refactor(sio): break circular dependency in source code
• 9b3c9ab fix(eio-client): only remove the event listener if it exists
• 043b55c refactor(sio): simplify middleware execution (bis)
• 32c761f refactor(sio): export the ExtendedError type
• 1f54ee0 refactor(sio): simplify middleware execution
• 923a12e fix(eio): discard all pending packets when the server is closed
• 13c6d2e fix(sio-client): allow to manually stop the reconnection loop
• 8adcfbf fix(sio-client): do not send a packet on an expired connection (#5134)
• 7a23dde perf: do not reset the hearbeat timer on each packet

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
cyber-city	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Oct 16, 2024 5:51am