[Snyk] Upgrade socket.io from 4.5.4 to 4.8.0 #69

charley04310 · 2024-10-16T01:50:49Z

Snyk has created this PR to upgrade socket.io from 4.5.4 to 4.8.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 11 versions ahead of your current version.
The recommended version was released 25 days ago, on 2024-09-21.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	375/1000 Why? CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JS-WS-7266574	375/1000 Why? CVSS 7.5	Proof of Concept
Uncaught Exception SNYK-JS-SOCKETIO-7278048	375/1000 Why? CVSS 7.5	No Known Exploit
Uncaught Exception SNYK-JS-ENGINEIO-5496331	375/1000 Why? CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

4.8.0 - 2024-09-21

Features

Custom transport implementations

The transports option now accepts an array of transport implementations:

import { io } from "socket.io-client";
import { XHR, WebSocket } from "engine.io-client";

const socket = io({
transports: [XHR, WebSocket]
});

Here is the list of provided implementations:

Transport	Description
`Fetch`	HTTP long-polling based on the built-in `fetch()` method.
`NodeXHR`	HTTP long-polling based on the `XMLHttpRequest` object provided by the `xmlhttprequest-ssl` package.
`XHR`	HTTP long-polling based on the built-in `XMLHttpRequest` object.
`NodeWebSocket`	WebSocket transport based on the `WebSocket` object provided by the `ws` package.
`WebSocket`	WebSocket transport based on the built-in `WebSocket` object.
`WebTransport`	WebTransport transport based on the built-in `WebTransport` object.

Usage:

Transport	browser	Node.js	Deno	Bun
`Fetch`	✅	✅ (1)	✅	✅
`NodeXHR`		✅	✅	✅
`XHR`	✅
`NodeWebSocket`		✅	✅	✅
`WebSocket`	✅	✅ (2)	✅	✅
`WebTransport`	✅	✅

(1) since v18.0.0
(2) since v21.0.0

Added in f4d898e and b11763b.

Test each low-level transports

When setting the tryAllTransports option to true, if the first transport (usually, HTTP long-polling) fails, then the other transports will be tested too:

import { io } from "socket.io-client";

const socket = io({
tryAllTransports: true
});

This feature is useful in two cases:

when HTTP long-polling is disabled on the server, or if CORS fails
when WebSocket is tested first (with transports: ["websocket", "polling"])

The only potential downside is that the connection attempt could take more time in case of failure, as there have been reports of WebSocket connection errors taking several seconds before being detected (that's one reason for using HTTP long-polling first). That's why the option defaults to false for now.

Added in 579b243.