[Snyk] Upgrade socket.io-client from 4.6.1 to 4.7.5

[codegrande]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade socket.io-client from 4.6.1 to 4.7.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 7 versions ahead of your current version.
• The recommended version was released 2 months ago, on 2024-03-14.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-5596892	375/1000 Why? CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io-client

• 4.7.5 - 2024-03-14
  

  Bug Fixes

  • discard acknowledgements upon disconnection (34cbfbb)

  Links

  • Diff: 4.7.4...4.7.5
  • Server release: 4.7.5
  • engine.io-client@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.4 - 2024-01-12
  

  There were some minor bug fixes on the server side, which mandate a client bump.

  Links

  • Diff: 4.7.3...4.7.4
  • Server release: 4.7.4
  • engine.io-client@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.3 - 2024-01-03
  

  Bug Fixes

  • improve compatibility with node16 module resolution (#1595) (605de78)
  • typings: accept string | undefined as init argument (5a3eafe)
  • typings: fix the type of the socket#id attribute (f9c16f2)

  Links

  • Diff: 4.7.2...4.7.3
  • Server release: 4.7.3
  • engine.io-client@~6.5.2 (no change)
  • ws@~8.11.0 (no change)
• 4.7.2 - 2023-08-02
  

  Some bug fixes are included from the engine.io-client package:

  • webtransport: add proper framing (d55c39e)
  • webtransport: honor the binaryType attribute (8270e00)

  Links

  • Diff: 4.7.1...4.7.2
  • Server release: 4.7.2
  • engine.io-client@~6.5.2 (diff)
  • ws@~8.11.0 (no change)
• 4.7.1 - 2023-06-28
  

  Some bug fixes are included from the engine.io-client package:

  • make closeOnBeforeunload default to false (a63066b)
  • webtransport: properly handle abruptly closed connections (cf6aa1f)

  Links

  • Diff: 4.7.0...4.7.1
  • Server release: 4.7.1
  • engine.io-client@~6.5.1 (diff)
  • ws@~8.11.0 (no change)
• 4.7.0 - 2023-06-22
  

  Bug Fixes

  • properly report timeout error when connecting (5bc94b5)
  • use same scope for setTimeout and clearTimeout calls (#1568) (f2892ab)

  Features

  Support for WebTransport

  The Engine.IO client can now use WebTransport as the underlying transport.

  WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

  References:

  • https://w3c.github.io/webtransport/
  • https://developer.mozilla.org/en-US/docs/Web/API/WebTransport
  • https://developer.chrome.com/articles/webtransport/

  For Node.js clients: until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

  import { WebTransport } from "@ fails-components/webtransport";

  global.WebTransport = WebTransport;

  Added in 7195c0f.

  Cookie management for the Node.js client

  When setting the withCredentials option to true, the Node.js client will now include the cookies in the HTTP requests, making it easier to use it with cookie-based sticky sessions.

  https://example.com", {
  withCredentials: true
  });">

  import { io } from "socket.io-client";
  
  const socket = io("https://example.com", {
  
  withCredentials: true
  
  });

  Added in 5fc88a6.

  Conditional import of the ESM build with debug logs

  By default, the ESM build does not include the debug package in the browser environments, because it increases the bundle size (see 16b6569).

  Which means that, unfortunately, debug logs are not available in the devtools console, even when setting the localStorage.debug = ... attribute.

  You can now import the build which includes the debug packages with a conditional import. Example with vite:

  import { defineConfig } from 'vite'
  import react from '@ vitejs/plugin-react'

  export default defineConfig({
  plugins: [react()],
  server: {
  port: 4000
  },
  resolve: {
  conditions: ["development"]
  }
  })

  Reference: https://v2.vitejs.dev/config/#resolve-conditions

  Added in 781d753.

  Links

  • Diff: 4.6.2...4.7.0
  • Server release: 4.7.0
  • engine.io-client version: ~6.5.0 (diff)
  • ws version: ~8.11.0 (no change)
• 4.6.2 - 2023-05-31
  

  Bug Fixes

  • exports: move types condition to the top (#1580) (7ead241)

  Links

  • Diff: 4.6.1...4.6.2
  • Server release: 4.6.2
  • engine.io-client version: ~6.4.0 (no change)
  • ws version: ~8.11.0 (no change)
• 4.6.1 - 2023-02-20
  

  Bug Fixes

  • do not drain the queue while the socket is offline (4996f9e)
  • prevent duplicate connections when multiplexing (46213a6)

  Links

  • Diff: 4.6.0...4.6.1
  • Server release: 4.6.1
  • engine.io-client version: ~6.4.0 (no change)
  • ws version: ~8.11.0 (no change)

from socket.io-client GitHub release notes

Commit messages

Package name: socket.io-client

• 4f6030f chore(release): 4.7.5
• 34cbfbb fix: discard acknowledgements upon disconnection
• 8cfea8c chore(release): 4.7.4
• ca5d50e chore(release): 4.7.3
• f9c16f2 fix(typings): fix the type of the socket#id attribute
• b3f0cab ci: add Node.js 20 in the test matrix
• 5a3eafe fix(typings): accept string | undefined as init argument
• 605de78 fix: improve compatibility with node16 module resolution (#1595)
• d00ccd2 ci: bump appiumVersion for Android tests in SauceLabs
• 928d76d chore(release): 4.7.2
• 74ca7ac chore: bump engine.io-client to version 6.5.2
• 0536fcc chore(release): 4.7.1
• 6169bb8 chore: bump dev dependencies
• 84ec6cf refactor: expose the ESM build with debug (bis)
• 630ff41 chore: bump engine.io-client to version 6.5.1
• 9b235ec chore(release): 4.7.0
• f2892ab fix: use same scope for setTimeout and clearTimeout calls (#1568)
• 5bc94b5 fix: properly report timeout error when connecting
• 781d753 feat: expose ESM build with debug (#1585)
• 8f14b98 chore: bump engine.io-client to version 6.5.0
• a04ae1b chore(release): 4.6.2
• 7c1db9d chore: bump socket.io-parser to version 4.2.3
• 61dea71 refactor: remove invalid comma from package.json
• 7ead241 fix(exports): move `types` condition to the top (#1580)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs