Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade socket.io from 1.7.4 to 4.5.2 #29

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade socket.io from 1.7.4 to 4.5.2 #29

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

@snyk-bot snyk-bot commented Nov 2, 2022

Snyk has created this PR to upgrade socket.io from 1.7.4 to 4.5.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 41 versions ahead of your current version.
  • The recommended version was released 2 months ago, on 2022-09-02.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Regular Expression Denial of Service (ReDoS)
npm:parsejson:20170908		 375/1000
Why? CVSS 7.5		 No Known Exploit
Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-1056752		 375/1000
Why? CVSS 7.5		 Proof of Concept
Denial of Service (DoS)
SNYK-JS-ENGINEIO-1056749		 375/1000
Why? CVSS 7.5		 Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 375/1000
Why? CVSS 7.5		 Proof of Concept
Insecure Defaults
SNYK-JS-SOCKETIO-1024859		 375/1000
Why? CVSS 7.5		 Proof of Concept
Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 375/1000
Why? CVSS 7.5		 No Known Exploit
Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 375/1000
Why? CVSS 7.5		 No Known Exploit
Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 375/1000
Why? CVSS 7.5		 No Known Exploit
Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 375/1000
Why? CVSS 7.5		 No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: socket.io
  • 4.5.2 - 2022-09-02

    Bug Fixes

    • prevent the socket from joining a room after disconnection (18f3fda)
    • uws: prevent the server from crashing after upgrade (ba497ee)

    Links:

  • 4.5.1 - 2022-05-17

    Bug Fixes

    • forward the local flag to the adapter when using fetchSockets() (30430f0)
    • typings: add HTTPS server to accepted types (#4351) (9b43c91)

    Links:

  • 4.5.0 - 2022-04-23

    Bug Fixes

    • typings: ensure compatibility with TypeScript 3.x (#4259) (02c87a8)

    Features

    • add support for catch-all listeners for outgoing packets (531104d)

    This is similar to onAny(), but for outgoing packets.

    Syntax:

    socket.onAnyOutgoing((event, ...args) => {
  console.log(event);
});
    • broadcast and expect multiple acks (8b20457)

    Syntax:

    io.timeout(1000).emit("some-event", (err, responses) => {
  // ...
});
    • add the "maxPayload" field in the handshake details (088dcb4)

    So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize
    value.

    This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as
    we only add a field in the JSON-encoded handshake data:

    0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

    Links:

  • 4.4.1 - 2022-01-06

    Bug Fixes

    • types: make RemoteSocket.data type safe (#4234) (770ee59)
    • types: pass SocketData type to custom namespaces (#4233) (f2b8de7)

    Links:

  • 4.4.0 - 2021-11-18

    Bug Fixes

    • only set 'connected' to true after middleware execution (02b0f73)

    Features

    • add an implementation based on uWebSockets.js (c0d8c5a)
    const { App } = require("uWebSockets.js");
    const { Server } = require("socket.io");

    const app = new App();
    const io = new Server();

    io.attachApp(app);

    io.on("connection", (socket) => {
    // ...
    });

    app.listen(3000, (token) => {
    if (!token) {
    console.warn("port already in use");
    }
    });

    socket.timeout(5000).emit("my-event", (err) => {
  if (err) {
    // the client did not acknowledge the event in the given delay
  }
});
    interface SocketData {
    name: string;
    age: number;
    }

    const io = new Server<ClientToServerEvents, ServerToClientEvents, InterServerEvents, SocketData>();

    io.on("connection", (socket) => {
    socket.data.name = "john";
    socket.data.age = 42;
    });

    Links:

  • 4.3.2 - 2021-11-08

    Bug Fixes

    • fix race condition in dynamic namespaces (#4137) (9d86397)

    Links:

  • 4.3.1 - 2021-10-16

    Bug Fixes

    Links:

  • 4.3.0 - 2021-10-14

    For this release, most of the work was done on the client side, see here.

    Bug Fixes

    • typings: add name field to cookie option (#4099) (033c5d3)
    • send volatile packets with binary attachments (dc81fcf)

    Features

    Links:

  • 4.2.0 - 2021-08-30
  • 4.1.3 - 2021-07-10
  • 4.1.2 - 2021-05-17
  • 4.1.1 - 2021-05-11
  • 4.1.0 - 2021-05-11
  • 4.0.2 - 2021-05-06
  • 4.0.1 - 2021-03-31
  • 4.0.0 - 2021-03-10
  • 3.1.2 - 2021-02-26
  • 3.1.1 - 2021-02-03
  • 3.1.0 - 2021-01-15
  • 3.0.5 - 2021-01-05
  • 3.0.4 - 2020-12-07
  • 3.0.3 - 2020-11-19
  • 3.0.2 - 2020-11-17
  • 3.0.1 - 2020-11-09
  • 3.0.0 - 2020-11-05
  • 3.0.0-rc4 - 2020-10-30
  • 3.0.0-rc3 - 2020-10-26
  • 3.0.0-rc2 - 2020-10-15
  • 3.0.0-rc1 - 2020-10-13
  • 2.5.0 - 2022-06-26

    ⚠️ WARNING ⚠️

    The default value of the maxHttpBufferSize option has been decreased from 100 MB to 1 MB, in order to prevent attacks by denial of service.

    Security advisory: GHSA-j4f2-536g-r55m

    Bug Fixes

    • fix race condition in dynamic namespaces (05e1278)
    • ignore packet received after disconnection (22d4bdf)
    • only set 'connected' to true after middleware execution (226cc16)
    • prevent the socket from joining a room after disconnection (f223178)

    Links:

  • 2.4.1 - 2021-01-07
  • 2.4.0 - 2021-01-04
  • 2.3.0 - 2019-09-20
  • 2.2.0 - 2018-11-28
  • 2.1.1 - 2018-05-17
  • 2.1.0 - 2018-03-29
  • 2.0.4 - 2017-10-22
  • 2.0.3 - 2017-06-12
  • 2.0.2 - 2017-06-01
  • 2.0.1 - 2017-05-08
  • 2.0.0 - 2017-05-08
  • 1.7.4 - 2017-05-07
from socket.io GitHub release notes
Commit messages
Package name: socket.io
  • 8be95b3 chore(release): 4.5.2
  • ba497ee fix(uws): prevent the server from crashing after upgrade
  • 2803871 ci: add explicit permissions to workflow (#4466)
  • 134226e refactor: add missing constraints (#4431)
  • 9890b03 chore: bump dependencies
  • 713a6b4 chore: bump mocha to version 10.0.0
  • 18f3fda fix: prevent the socket from joining a room after disconnection
  • 5ab8289 chore(release): 4.5.1
  • 30430f0 fix: forward the local flag to the adapter when using fetchSockets()
  • 9b43c91 fix(typings): add HTTPS server to accepted types (#4351)
  • 8ecfcba chore(release): 4.5.0
  • 572133a docs(examples): update example with webpack
  • 6e1bb62 chore: bump engine.io to version 6.2.0
  • 06e6838 docs(examples): add server bundling example with rollup
  • 1f03a44 docs(examples): update create-react-app example (#4347)
  • be3d7f0 docs(examples): add TODO example with Postgres and Node.js cluster
  • d12aab2 docs(examples): add example with express-session
  • 9f75868 docs(examples): pin the version of karma-jasmine-html-reporter
  • 0b35dc7 refactor: make the protocol implementation stricter
  • 531104d feat: add support for catch-all listeners for outgoing packets
  • 8b20457 feat: broadcast and expect multiple acks
  • 0b7d70c chore: bump lockfile to v2
  • 2f96438 chore: bump engine.io version to fix CVE-2022-21676 (#4262)
  • 02c87a8 fix(typings): ensure compatibility with TypeScript 3.x (#4259)

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot