Skip to content

Update dependency socket.io to v4.6.2 [SECURITY] - #8

Open
2tle wants to merge 1 commit into
masterfrom
renovate/npm-socket.io-vulnerability
Open

Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom
renovate/npm-socket.io-vulnerability

Conversation

@2tle

@2tle2tle commented Apr 22, 2025

Copy link
Copy Markdown
Owner

This PR contains the following updates:

PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2

GitHub Vulnerability Alerts

CVE-2020-28481

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

CVE-2024-38355

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions

Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1

Patches

This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).

The fix was backported in the 2.x branch today: socketio/socket.io@d30630b

Workarounds

As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:

io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});

For more information

If you have any questions or comments about this advisory:

  • Open a discussion here

Thanks a lot to Paul Taylor for the responsible disclosure.

References

Release Notes

socketio/socket.io (socket.io)

v4.6.2

Compare Source

Bug Fixes
Links

v4.6.1

Compare Source

Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links

v4.6.0

Compare Source

Bug Fixes
Features
Promise-based acknowledgements

This commit adds some syntactic sugar around acknowledgements:

  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}

Added in 184f3cf.

Connection state recovery

This feature allows a client to reconnect after a temporary disconnection and restore its state:

  • id
  • rooms
  • data
  • missed packets

Usage:

import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});

Here's how it works:

  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state

The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.

Added in 54d5ee0.

Compatibility (for real) with Express middlewares

This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.

Syntax:

io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());

A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.

Added in 24786e7.

Error details in the disconnecting and disconnect events

The disconnect event will now contain additional details about the disconnection reason.

io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});

Added in 8aa9499.

Automatic removal of empty child namespaces

This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.

import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});

Added in 5d9220b.

A new "addTrailingSlash" option

The trailing slash which was added by default can now be disabled:

import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});

In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.

Added in d0fd474.

Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:

v4.5.4

Compare Source

This release contains a bump of:

Links:

v4.5.3

Compare Source

Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:

v4.5.2

Compare Source

Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:

v4.5.1

Compare Source

Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:

v4.5.0

Compare Source

Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)

This is similar to onAny(), but for outgoing packets.

Syntax:

socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)

Syntax:

io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)

So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize
value.

This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as
we only add a field in the JSON-encoded handshake data:

0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}
Links:

v4.4.1

Compare Source

Bug Fixes
Links:

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@2tle
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Update dependency socket.io to v4.6.2 [SECURITY] by 2tle · Pull Request #8 · 2tle/SurvirunAPI · GitHub
Skip to content
Update dependency socket.io to v4.6.2 [SECURITY] - #8
Open
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Open
Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Conversation
@2tle
@2tle2tle
commented
Apr 22, 2025

Copy link


Copy Markdown

Owner
This PR contains the following updates:
PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2
GitHub Vulnerability Alerts
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVE-2024-38355
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions
Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1
Patches
This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: socketio/socket.io@d30630b
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});
For more information
If you have any questions or comments about this advisory:
  • Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Release Notes
socketio/socket.io (socket.io)
v4.6.2
Compare Source
Bug Fixes
Links
v4.6.1
Compare Source
Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links
v4.6.0
Compare Source
Bug Fixes
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}
Added in 184f3cf.
Connection state recovery
This feature allows a client to reconnect after a temporary disconnection and restore its state:
  • id
  • rooms
  • data
  • missed packets
Usage:
import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});
Here's how it works:
  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state
The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.
Added in 54d5ee0.
Compatibility (for real) with Express middlewares
This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
Syntax:
io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());
A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.
Added in 24786e7.
Error details in the disconnecting and disconnect events
The disconnect event will now contain additional details about the disconnection reason.
io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});
Added in 8aa9499.
Automatic removal of empty child namespaces
This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});
Added in 5d9220b.
A new "addTrailingSlash" option
The trailing slash which was added by default can now be disabled:
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});
In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.
Added in d0fd474.
Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:
v4.5.4
Compare Source
This release contains a bump of:
Links:
v4.5.3
Compare Source
Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:
v4.5.2
Compare Source
Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:
v4.5.1
Compare Source
Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:
v4.5.0
Compare Source
Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)
This is similar to onAny(), but for outgoing packets.
Syntax:
socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)
Syntax:
io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize

value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as

we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links:
v4.4.1
Compare Source
Bug Fixes
Links:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR has been generated by Renovate Bot.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@2tle

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency socket.io to v4.6.2 [SECURITY] by 2tle · Pull Request #8 · 2tle/SurvirunAPI · GitHub
Skip to content
Update dependency socket.io to v4.6.2 [SECURITY] - #8
Open
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Open
Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Conversation
@2tle
@2tle2tle
commented
Apr 22, 2025

Copy link


Copy Markdown

Owner
This PR contains the following updates:
PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2
GitHub Vulnerability Alerts
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVE-2024-38355
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions
Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1
Patches
This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: socketio/socket.io@d30630b
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});
For more information
If you have any questions or comments about this advisory:
  • Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Release Notes
socketio/socket.io (socket.io)
v4.6.2
Compare Source
Bug Fixes
Links
v4.6.1
Compare Source
Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links
v4.6.0
Compare Source
Bug Fixes
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}
Added in 184f3cf.
Connection state recovery
This feature allows a client to reconnect after a temporary disconnection and restore its state:
  • id
  • rooms
  • data
  • missed packets
Usage:
import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});
Here's how it works:
  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state
The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.
Added in 54d5ee0.
Compatibility (for real) with Express middlewares
This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
Syntax:
io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());
A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.
Added in 24786e7.
Error details in the disconnecting and disconnect events
The disconnect event will now contain additional details about the disconnection reason.
io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});
Added in 8aa9499.
Automatic removal of empty child namespaces
This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});
Added in 5d9220b.
A new "addTrailingSlash" option
The trailing slash which was added by default can now be disabled:
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});
In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.
Added in d0fd474.
Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:
v4.5.4
Compare Source
This release contains a bump of:
Links:
v4.5.3
Compare Source
Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:
v4.5.2
Compare Source
Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:
v4.5.1
Compare Source
Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:
v4.5.0
Compare Source
Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)
This is similar to onAny(), but for outgoing packets.
Syntax:
socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)
Syntax:
io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize

value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as

we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links:
v4.4.1
Compare Source
Bug Fixes
Links:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR has been generated by Renovate Bot.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@2tle

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency socket.io to v4.6.2 [SECURITY] by 2tle · Pull Request #8 · 2tle/SurvirunAPI · GitHub
Skip to content
Update dependency socket.io to v4.6.2 [SECURITY] - #8
Open
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Open
Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Conversation
@2tle
@2tle2tle
commented
Apr 22, 2025

Copy link


Copy Markdown

Owner
This PR contains the following updates:
PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2
GitHub Vulnerability Alerts
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVE-2024-38355
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions
Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1
Patches
This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: socketio/socket.io@d30630b
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});
For more information
If you have any questions or comments about this advisory:
  • Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Release Notes
socketio/socket.io (socket.io)
v4.6.2
Compare Source
Bug Fixes
Links
v4.6.1
Compare Source
Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links
v4.6.0
Compare Source
Bug Fixes
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}
Added in 184f3cf.
Connection state recovery
This feature allows a client to reconnect after a temporary disconnection and restore its state:
  • id
  • rooms
  • data
  • missed packets
Usage:
import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});
Here's how it works:
  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state
The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.
Added in 54d5ee0.
Compatibility (for real) with Express middlewares
This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
Syntax:
io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());
A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.
Added in 24786e7.
Error details in the disconnecting and disconnect events
The disconnect event will now contain additional details about the disconnection reason.
io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});
Added in 8aa9499.
Automatic removal of empty child namespaces
This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});
Added in 5d9220b.
A new "addTrailingSlash" option
The trailing slash which was added by default can now be disabled:
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});
In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.
Added in d0fd474.
Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:
v4.5.4
Compare Source
This release contains a bump of:
Links:
v4.5.3
Compare Source
Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:
v4.5.2
Compare Source
Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:
v4.5.1
Compare Source
Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:
v4.5.0
Compare Source
Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)
This is similar to onAny(), but for outgoing packets.
Syntax:
socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)
Syntax:
io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize

value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as

we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links:
v4.4.1
Compare Source
Bug Fixes
Links:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR has been generated by Renovate Bot.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@2tle

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Update dependency socket.io to v4.6.2 [SECURITY] by 2tle · Pull Request #8 · 2tle/SurvirunAPI · GitHub
Skip to content
Update dependency socket.io to v4.6.2 [SECURITY] - #8
Open
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Open
Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Conversation
@2tle
@2tle2tle
commented
Apr 22, 2025

Copy link


Copy Markdown

Owner
This PR contains the following updates:
PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2
GitHub Vulnerability Alerts
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVE-2024-38355
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions
Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1
Patches
This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: socketio/socket.io@d30630b
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});
For more information
If you have any questions or comments about this advisory:
  • Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Release Notes
socketio/socket.io (socket.io)
v4.6.2
Compare Source
Bug Fixes
Links
v4.6.1
Compare Source
Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links
v4.6.0
Compare Source
Bug Fixes
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}
Added in 184f3cf.
Connection state recovery
This feature allows a client to reconnect after a temporary disconnection and restore its state:
  • id
  • rooms
  • data
  • missed packets
Usage:
import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});
Here's how it works:
  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state
The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.
Added in 54d5ee0.
Compatibility (for real) with Express middlewares
This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
Syntax:
io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());
A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.
Added in 24786e7.
Error details in the disconnecting and disconnect events
The disconnect event will now contain additional details about the disconnection reason.
io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});
Added in 8aa9499.
Automatic removal of empty child namespaces
This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});
Added in 5d9220b.
A new "addTrailingSlash" option
The trailing slash which was added by default can now be disabled:
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});
In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.
Added in d0fd474.
Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:
v4.5.4
Compare Source
This release contains a bump of:
Links:
v4.5.3
Compare Source
Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:
v4.5.2
Compare Source
Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:
v4.5.1
Compare Source
Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:
v4.5.0
Compare Source
Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)
This is similar to onAny(), but for outgoing packets.
Syntax:
socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)
Syntax:
io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize

value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as

we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links:
v4.4.1
Compare Source
Bug Fixes
Links:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR has been generated by Renovate Bot.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@2tle

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency socket.io to v4.6.2 [SECURITY] by 2tle · Pull Request #8 · 2tle/SurvirunAPI · GitHub
Skip to content
Update dependency socket.io to v4.6.2 [SECURITY] - #8
Open
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Open
Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Conversation
@2tle
@2tle2tle
commented
Apr 22, 2025

Copy link


Copy Markdown

Owner
This PR contains the following updates:
PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2
GitHub Vulnerability Alerts
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVE-2024-38355
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions
Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1
Patches
This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: socketio/socket.io@d30630b
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});
For more information
If you have any questions or comments about this advisory:
  • Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Release Notes
socketio/socket.io (socket.io)
v4.6.2
Compare Source
Bug Fixes
Links
v4.6.1
Compare Source
Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links
v4.6.0
Compare Source
Bug Fixes
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}
Added in 184f3cf.
Connection state recovery
This feature allows a client to reconnect after a temporary disconnection and restore its state:
  • id
  • rooms
  • data
  • missed packets
Usage:
import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});
Here's how it works:
  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state
The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.
Added in 54d5ee0.
Compatibility (for real) with Express middlewares
This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
Syntax:
io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());
A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.
Added in 24786e7.
Error details in the disconnecting and disconnect events
The disconnect event will now contain additional details about the disconnection reason.
io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});
Added in 8aa9499.
Automatic removal of empty child namespaces
This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});
Added in 5d9220b.
A new "addTrailingSlash" option
The trailing slash which was added by default can now be disabled:
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});
In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.
Added in d0fd474.
Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:
v4.5.4
Compare Source
This release contains a bump of:
Links:
v4.5.3
Compare Source
Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:
v4.5.2
Compare Source
Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:
v4.5.1
Compare Source
Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:
v4.5.0
Compare Source
Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)
This is similar to onAny(), but for outgoing packets.
Syntax:
socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)
Syntax:
io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize

value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as

we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links:
v4.4.1
Compare Source
Bug Fixes
Links:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR has been generated by Renovate Bot.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@2tle

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Update dependency socket.io to v4.6.2 [SECURITY] by 2tle · Pull Request #8 · 2tle/SurvirunAPI · GitHub
Skip to content
Update dependency socket.io to v4.6.2 [SECURITY] - #8
Open
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Open
Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Conversation
@2tle
@2tle2tle
commented
Apr 22, 2025

Copy link


Copy Markdown

Owner
This PR contains the following updates:
PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2
GitHub Vulnerability Alerts
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVE-2024-38355
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions
Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1
Patches
This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: socketio/socket.io@d30630b
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});
For more information
If you have any questions or comments about this advisory:
  • Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Release Notes
socketio/socket.io (socket.io)
v4.6.2
Compare Source
Bug Fixes
Links
v4.6.1
Compare Source
Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links
v4.6.0
Compare Source
Bug Fixes
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}
Added in 184f3cf.
Connection state recovery
This feature allows a client to reconnect after a temporary disconnection and restore its state:
  • id
  • rooms
  • data
  • missed packets
Usage:
import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});
Here's how it works:
  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state
The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.
Added in 54d5ee0.
Compatibility (for real) with Express middlewares
This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
Syntax:
io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());
A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.
Added in 24786e7.
Error details in the disconnecting and disconnect events
The disconnect event will now contain additional details about the disconnection reason.
io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});
Added in 8aa9499.
Automatic removal of empty child namespaces
This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});
Added in 5d9220b.
A new "addTrailingSlash" option
The trailing slash which was added by default can now be disabled:
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});
In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.
Added in d0fd474.
Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:
v4.5.4
Compare Source
This release contains a bump of:
Links:
v4.5.3
Compare Source
Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:
v4.5.2
Compare Source
Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:
v4.5.1
Compare Source
Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:
v4.5.0
Compare Source
Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)
This is similar to onAny(), but for outgoing packets.
Syntax:
socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)
Syntax:
io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize

value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as

we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links:
v4.4.1
Compare Source
Bug Fixes
Links:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR has been generated by Renovate Bot.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@2tle

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Update dependency socket.io to v4.6.2 [SECURITY] by 2tle · Pull Request #8 · 2tle/SurvirunAPI · GitHub
Skip to content
Update dependency socket.io to v4.6.2 [SECURITY] - #8
Open
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Open
Update dependency socket.io to v4.6.2 [SECURITY]#8
2tle wants to merge 1 commit into
masterfrom 
renovate/npm-socket.io-vulnerability
Conversation
@2tle
@2tle2tle
commented
Apr 22, 2025

Copy link


Copy Markdown

Owner
This PR contains the following updates:
PackageTypeUpdateChange
socket.io (source)dependenciesminor4.4.0 -> 4.6.2
GitHub Vulnerability Alerts
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
CVE-2024-38355
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
node:events:502
throw err; // Unhandled 'error' event
^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
at new NodeError (node:internal/errors:405:5)
at Socket.emit (node:events:500:17)
at /myapp/node_modules/socket.io/lib/socket.js:531:14
at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
code: 'ERR_UNHANDLED_ERROR',
context: undefined
}

Affected versions
Version rangeNeeds minor update?
4.6.2...latestNothing to do
3.0.0...4.6.1Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0Please upgrade to socket.io@2.5.1
Patches
This issue is fixed by socketio/socket.io@15af22f, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: socketio/socket.io@d30630b
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
io.on("connection",(socket)=>{socket.on("error",()=>{// ...});});
For more information
If you have any questions or comments about this advisory:
  • Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Release Notes
socketio/socket.io (socket.io)
v4.6.2
Compare Source
Bug Fixes
Links
v4.6.1
Compare Source
Bug Fixes
  • properly handle manually created dynamic namespaces (0d0a7a2)
  • types: fix nodenext module resolution compatibility (#​4625) (d0b22c6)
Links
v4.6.0
Compare Source
Bug Fixes
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
  • emitWithAck()
try{constresponses=awaitio.timeout(1000).emitWithAck("some-event");console.log(responses);// one response per client}catch(e){// some clients did not acknowledge the event in the given delay}io.on("connection",async(socket)=>{// without timeoutconstresponse=awaitsocket.emitWithAck("hello","world");// with a specific timeouttry{constresponse=awaitsocket.timeout(1000).emitWithAck("hello","world");}catch(err){// the client did not acknowledge the event in the given delay}});
  • serverSideEmitWithAck()
try{constresponses=awaitio.timeout(1000).serverSideEmitWithAck("some-event");console.log(responses);// one response per server (except itself)}catch(e){// some servers did not acknowledge the event in the given delay}
Added in 184f3cf.
Connection state recovery
This feature allows a client to reconnect after a temporary disconnection and restore its state:
  • id
  • rooms
  • data
  • missed packets
Usage:
import{Server}from"socket.io";constio=newServer({connectionStateRecovery: {// default valuesmaxDisconnectionDuration: 2*60*1000,skipMiddlewares: true,},});io.on("connection",(socket)=>{console.log(socket.recovered);// whether the state was recovered or not});
Here's how it works:
  • the server sends a session ID during the handshake (which is different from the current id attribute, which is public and can be freely shared)
  • the server also includes an offset in each packet (added at the end of the data array, for backward compatibility)
  • upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level)
  • upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state
The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on Redis Streams, which will support this feature.
Added in 54d5ee0.
Compatibility (for real) with Express middlewares
This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
Syntax:
io.engine.use((req,res,next)=>{// do somethingnext();});// with express-sessionimportsessionfrom"express-session";io.engine.use(session({secret: "keyboard cat",resave: false,saveUninitialized: true,cookie: {secure: true}}));// with helmetimporthelmetfrom"helmet";io.engine.use(helmet());
A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.
Added in 24786e7.
Error details in the disconnecting and disconnect events
The disconnect event will now contain additional details about the disconnection reason.
io.on("connection",(socket)=>{socket.on("disconnect",(reason,description)=>{console.log(description);});});
Added in 8aa9499.
Automatic removal of empty child namespaces
This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed.
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{cleanupEmptyChildNamespaces: true});
Added in 5d9220b.
A new "addTrailingSlash" option
The trailing slash which was added by default can now be disabled:
import{createServer}from"node:http";import{Server}from"socket.io";consthttpServer=createServer();constio=newServer(httpServer,{addTrailingSlash: false});
In the example above, the clients can omit the trailing slash and use /socket.io instead of /socket.io/.
Added in d0fd474.
Performance Improvements
  • precompute the WebSocket frames when broadcasting (da2b542)
Links:
v4.5.4
Compare Source
This release contains a bump of:
Links:
v4.5.3
Compare Source
Bug Fixes
  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)
Links:
v4.5.2
Compare Source
Bug Fixes
  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)
Links:
v4.5.1
Compare Source
Bug Fixes
  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#​4351) (9b43c91)
Links:
v4.5.0
Compare Source
Bug Fixes
Features
  • add support for catch-all listeners for outgoing packets (531104d)
This is similar to onAny(), but for outgoing packets.
Syntax:
socket.onAnyOutgoing((event, ...args)=>{console.log(event);});
  • broadcast and expect multiple acks (8b20457)
Syntax:
io.timeout(1000).emit("some-event",(err,responses)=>{// ...});
  • add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize

value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as

we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links:
v4.4.1
Compare Source
Bug Fixes
Links:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR has been generated by Renovate Bot.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@2tle