[Snyk] Upgrade socket.io from 4.6.0 to 4.6.1

[glutamate]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade socket.io from 4.6.0 to 4.6.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.
• The recommended version was released 21 days ago, on 2023-02-20.

Release notes

Package name: socket.io

• 4.6.1 - 2023-02-20
  

  Bug Fixes

  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#4625) (d0b22c6)

  Links

  • Diff: 4.6.0...4.6.1
  • Client release: 4.6.1
  • engine.io@~6.4.1 (diff)
  • ws@~8.11.0 (no change)
• 4.6.0 - 2023-02-07
  

  Bug Fixes

  • add timeout method to remote socket (#4558) (0c0eb00)
  • typings: properly type emits with timeout (f3ada7d)

  Features

  Promise-based acknowledgements

  This commit adds some syntactic sugar around acknowledgements:

  • emitWithAck()
  try {
  const responses = await io.timeout(1000).emitWithAck("some-event");
  console.log(responses); // one response per client
  } catch (e) {
  // some clients did not acknowledge the event in the given delay
  }

  io.on("connection", async (socket) => {
  // without timeout
  const response = await socket.emitWithAck("hello", "world");

  // with a specific timeout
  try {
  const response = await socket.timeout(1000).emitWithAck("hello", "world");
  } catch (err) {
  // the client did not acknowledge the event in the given delay
  }
  });

  • serverSideEmitWithAck()

  try {
    const responses = await io.timeout(1000).serverSideEmitWithAck("some-event");
    console.log(responses); // one response per server (except itself)
  } catch (e) {
    // some servers did not acknowledge the event in the given delay
  }

  Added in 184f3cf.

  Connection state recovery

  This feature allows a client to reconnect after a temporary disconnection and restore its state:

  • id
  • rooms
  • data
  • missed packets

  Usage:

  import { Server } from "socket.io";

  const io = new Server({
  connectionStateRecovery: {
  // default values
  maxDisconnectionDuration: 2 60 1000,
  skipMiddlewares: true,
  },
  });

  io.on("connection", (socket) => {
  console.log(socket.recovered); // whether the state was recovered or not
  });

  Here's how it works:

  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state

  The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.

  Added in 54d5ee0.

  Compatibility (for real) with Express middlewares

  This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.

  Syntax:

  io.engine.use((req, res, next) => {
  // do something

  next();
  });

  // with express-session
  import session from "express-session";

  io.engine.use(session({
  secret: "keyboard cat",
  resave: false,
  saveUninitialized: true,
  cookie: { secure: true }
  }));

  // with helmet
  import helmet from "helmet";

  io.engine.use(helmet());

  A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.

  Added in 24786e7.

  Error details in the disconnecting and disconnect events

  The disconnect event will now contain additional details about the disconnection reason.

  io.on("connection", (socket) => {
    socket.on("disconnect", (reason, description) => {
      console.log(description);
    });
  });

  Added in 8aa9499.

  Automatic removal of empty child namespaces

  This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.

  import { createServer } from "node:http";
  import { Server } from "socket.io";

  const httpServer = createServer();
  const io = new Server(httpServer, {
  cleanupEmptyChildNamespaces: true
  });

  Added in 5d9220b.

  A new "addTrailingSlash" option

  The trailing slash which was added by default can now be disabled:

  import { createServer } from "node:http";
  import { Server } from "socket.io";

  const httpServer = createServer();
  const io = new Server(httpServer, {
  addTrailingSlash: false
  });

  In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.

  Added in d0fd474.

  Performance Improvements

  • precompute the WebSocket frames when broadcasting (da2b542)

  Links:

  • Diff: 4.5.4...4.6.0
  • Client release: 4.6.0
  • engine.io@~6.4.0 (diff)
  • ws@~8.11.0 (diff)

from socket.io GitHub release notes

Commit messages

Package name: socket.io

• 7952312 chore(release): 4.6.1
• 0d0a7a2 fix: properly handle manually created dynamic namespaces
• 2a8565f refactor: catch errors when trying to restore the connection state
• d0b22c6 fix(types): fix nodenext module resolution compatibility (#4625)
• e71f3d7 docs: minor style fix (#4619)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs