Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade socket.io from 1.7.4 to 4.5.0 #19

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade socket.io from 1.7.4 to 4.5.0 #19

wants to merge 1 commit into from

Conversation

ukmadlz
Copy link

@ukmadlz ukmadlz commented May 18, 2022

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade socket.io from 1.7.4 to 4.5.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 38 versions ahead of your current version.
  • The recommended version was released 24 days ago, on 2022-04-23.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Denial of Service (DoS)
SNYK-JS-ENGINEIO-1056749		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Proof of Concept
Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-1056752		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Proof of Concept
Regular Expression Denial of Service (ReDoS)
npm:parsejson:20170908		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 No Known Exploit
Insecure Defaults
SNYK-JS-SOCKETIO-1024859		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Proof of Concept
Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 No Known Exploit
Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 No Known Exploit
Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 No Known Exploit
Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: socket.io
  • 4.5.0 - 2022-04-23

    Bug Fixes

    • typings: ensure compatibility with TypeScript 3.x (#4259) (02c87a8)

    Features

    • add support for catch-all listeners for outgoing packets (531104d)

    This is similar to onAny(), but for outgoing packets.

    Syntax:

    socket.onAnyOutgoing((event, ...args) => {
  console.log(event);
});
    • broadcast and expect multiple acks (8b20457)

    Syntax:

    io.timeout(1000).emit("some-event", (err, responses) => {
  // ...
});
    • add the "maxPayload" field in the handshake details (088dcb4)

    So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize
    value.

    This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as
    we only add a field in the JSON-encoded handshake data:

    0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

    Links:

  • 4.4.1 - 2022-01-06

    Bug Fixes

    • types: make RemoteSocket.data type safe (#4234) (770ee59)
    • types: pass SocketData type to custom namespaces (#4233) (f2b8de7)

    Links:

  • 4.4.0 - 2021-11-18

    Bug Fixes

    • only set 'connected' to true after middleware execution (02b0f73)

    Features

    • add an implementation based on uWebSockets.js (c0d8c5a)
    const { App } = require("uWebSockets.js");
    const { Server } = require("socket.io");

    const app = new App();
    const io = new Server();

    io.attachApp(app);

    io.on("connection", (socket) => {
    // ...
    });

    app.listen(3000, (token) => {
    if (!token) {
    console.warn("port already in use");
    }
    });

    socket.timeout(5000).emit("my-event", (err) => {
  if (err) {
    // the client did not acknowledge the event in the given delay
  }
});
    interface SocketData {
    name: string;
    age: number;
    }

    const io = new Server<ClientToServerEvents, ServerToClientEvents, InterServerEvents, SocketData>();

    io.on("connection", (socket) => {
    socket.data.name = "john";
    socket.data.age = 42;
    });

    Links:

  • 4.3.2 - 2021-11-08

    Bug Fixes

    • fix race condition in dynamic namespaces (#4137) (9d86397)

    Links:

  • 4.3.1 - 2021-10-16

    Bug Fixes

    Links:

  • 4.3.0 - 2021-10-14

    For this release, most of the work was done on the client side, see here.

    Bug Fixes

    • typings: add name field to cookie option (#4099) (033c5d3)
    • send volatile packets with binary attachments (dc81fcf)

    Features

    Links:

  • 4.2.0 - 2021-08-30

    Bug Fixes

    • typings: allow async listener in typed events (ccfd8ca)

    Features

    • ignore the query string when serving client JavaScript (#4024) (24fee27)

    Links:

  • 4.1.3 - 2021-07-10

    Bug Fixes

    • fix io.except() method (94e27cd)
    • remove x-sourcemap header (a4dffc6)

    Links:

  • 4.1.2 - 2021-05-17

    Bug Fixes

    • typings: ensure compatibility with TypeScript 3.x (0cb6ac9)
    • ensure compatibility with previous versions of the adapter (a2cf248)

    Links:

  • 4.1.1 - 2021-05-11
  • 4.1.0 - 2021-05-11
  • 4.0.2 - 2021-05-06
  • 4.0.1 - 2021-03-31
  • 4.0.0 - 2021-03-10
  • 3.1.2 - 2021-02-26
  • 3.1.1 - 2021-02-03
  • 3.1.0 - 2021-01-15
  • 3.0.5 - 2021-01-05
  • 3.0.4 - 2020-12-07
  • 3.0.3 - 2020-11-19
  • 3.0.2 - 2020-11-17
  • 3.0.1 - 2020-11-09
  • 3.0.0 - 2020-11-05
  • 3.0.0-rc4 - 2020-10-30
  • 3.0.0-rc3 - 2020-10-26
  • 3.0.0-rc2 - 2020-10-15
  • 3.0.0-rc1 - 2020-10-13
  • 2.4.1 - 2021-01-07
  • 2.4.0 - 2021-01-04
  • 2.3.0 - 2019-09-20
  • 2.2.0 - 2018-11-28
  • 2.1.1 - 2018-05-17
  • 2.1.0 - 2018-03-29
  • 2.0.4 - 2017-10-22
  • 2.0.3 - 2017-06-12
  • 2.0.2 - 2017-06-01
  • 2.0.1 - 2017-05-08
  • 2.0.0 - 2017-05-08
  • 1.7.4 - 2017-05-07
from socket.io GitHub release notes
Commit messages
Package name: socket.io
  • 8ecfcba chore(release): 4.5.0
  • 572133a docs(examples): update example with webpack
  • 6e1bb62 chore: bump engine.io to version 6.2.0
  • 06e6838 docs(examples): add server bundling example with rollup
  • 1f03a44 docs(examples): update create-react-app example (#4347)
  • be3d7f0 docs(examples): add TODO example with Postgres and Node.js cluster
  • d12aab2 docs(examples): add example with express-session
  • 9f75868 docs(examples): pin the version of karma-jasmine-html-reporter
  • 0b35dc7 refactor: make the protocol implementation stricter
  • 531104d feat: add support for catch-all listeners for outgoing packets
  • 8b20457 feat: broadcast and expect multiple acks
  • 0b7d70c chore: bump lockfile to v2
  • 2f96438 chore: bump engine.io version to fix CVE-2022-21676 (#4262)
  • 02c87a8 fix(typings): ensure compatibility with TypeScript 3.x (#4259)
  • 37b6d8f chore: update default label for bug reports
  • af54565 docs: remove broken badges
  • aa5312a chore: revert to lockfile v1
  • c82a4bd chore(release): 4.4.1
  • 770ee59 fix(types): make `RemoteSocket.data` type safe (#4234)
  • 3bf5d92 refactor: add note about fetchSockets() for parent namespaces
  • fc82e44 refactor(typings): export Event type (#4215)
  • c840bad test: fix flaky tests
  • f2b8de7 fix(typings): pass `SocketData` type to custom namespaces (#4233)
  • 51784d0 chore: add types to exports field to be compatible with nodenext module resolution (#4228)

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ukmadlz @snyk-bot