[Snyk] Upgrade socket.io from 4.7.5 to 4.8.0 #10

Tobsukka · 2024-10-18T02:35:57Z

Snyk has created this PR to upgrade socket.io from 4.7.5 to 4.8.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 1 version ahead of your current version.
The recommended version was released a month ago, on 2024-09-21.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	386/1000 Why? Recently disclosed, CVSS 6.3	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

4.8.0 - 2024-09-21

Features

Custom transport implementations

The transports option now accepts an array of transport implementations:

import { io } from "socket.io-client";
import { XHR, WebSocket } from "engine.io-client";

const socket = io({
transports: [XHR, WebSocket]
});

Here is the list of provided implementations:

Transport	Description
`Fetch`	HTTP long-polling based on the built-in `fetch()` method.
`NodeXHR`	HTTP long-polling based on the `XMLHttpRequest` object provided by the `xmlhttprequest-ssl` package.
`XHR`	HTTP long-polling based on the built-in `XMLHttpRequest` object.
`NodeWebSocket`	WebSocket transport based on the `WebSocket` object provided by the `ws` package.
`WebSocket`	WebSocket transport based on the built-in `WebSocket` object.
`WebTransport`	WebTransport transport based on the built-in `WebTransport` object.

Usage:

Transport	browser	Node.js	Deno	Bun
`Fetch`	✅	✅ (1)	✅	✅
`NodeXHR`		✅	✅	✅
`XHR`	✅
`NodeWebSocket`		✅	✅	✅
`WebSocket`	✅	✅ (2)	✅	✅
`WebTransport`	✅	✅

(1) since v18.0.0
(2) since v21.0.0

Added in f4d898e and b11763b.

Test each low-level transports

When setting the tryAllTransports option to true, if the first transport (usually, HTTP long-polling) fails, then the other transports will be tested too:

import { io } from "socket.io-client";

const socket = io({
tryAllTransports: true
});

This feature is useful in two cases:

when HTTP long-polling is disabled on the server, or if CORS fails
when WebSocket is tested first (with transports: ["websocket", "polling"])

The only potential downside is that the connection attempt could take more time in case of failure, as there have been reports of WebSocket connection errors taking several seconds before being detected (that's one reason for using HTTP long-polling first). That's why the option defaults to false for now.

Added in 579b243.