fix(deps): bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 by chargome · Pull Request #19880 · getsentry/sentry-javascript

chargome · 2026-03-19T12:57:39Z

Fixes Dependabot alert #1223. Bumps socket.io-parser from 4.2.4 to 4.2.6 to address unbounded binary attachment memory exhaustion vulnerability.

Fixes Dependabot alert #1223. Bumps socket.io-parser from 4.2.4 to 4.2.6 to address unbounded binary attachment memory exhaustion vulnerability. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-03-19T13:02:04Z

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

New Features ✨

(remix) Server Timing Headers Trace Propagation by onurtemizkan in #18653

Bug Fixes 🐛

Deps

Bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 by chargome in #19880

Bump next to 15.5.13/16.1.7 to fix CVE-2026-1525, CVE-202-33036 and related by chargome in #19870
Bump devalue 5.6.3 to 5.6.4 to fix CVE-2026-30226 by chargome in #19849
Bump file-type to 21.3.2 and @nestjs/common to 11.1.17 by chargome in #19847
Bump unhead 2.1.4 to 2.1.12 to fix CVE-2026-31860 and CVE-2026-31873 by chargome in #19848
Bump flatted 3.3.1 to 3.4.2 to fix CVE-2026-32141 by chargome in #19842
Bump tar 7.5.10 to 7.5.11 to fix CVE-2026-31802 by chargome in #19846
Bump hono 4.12.5 to 4.12.7 in cloudflare-hono E2E test app by chargome in #19850
Bump undici 6.23.0 to 6.24.1 to fix multiple CVEs by chargome in #19841

Other

(cloudflare) Use correct env types for withSentry by JPeer264 in #19836
(core) Align error span status message with core SpanStatusType for langchain/google-genai by nicohrubec in #19863
(deno) Clear pre-existing OTel global before registering TracerProvider by sergical in #19723
(nextjs) Skip tracing for tunnel requests by chargome in #19861
(node-core) Recycle propagationContext for each request by Lms24 in #19835

Internal Changes 🔧

(core) Simplify core utility functions for smaller bundle by HazAT in #19854
(deps) Bump next from 16.1.5 to 16.1.7 in /dev-packages/e2e-tests/test-applications/nextjs-16 by dependabot in #19851
(nextjs) Skip broken ISR tests by chargome in #19871
(react) Add gql tests for react router by chargome in #19844
(release) Switch from action-prepare-release to Craft by BYK in #18763

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-03-19T13:09:56Z

size-limit report 📦

⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Path	Size	% Change	Change
@sentry/browser	25.52 kB	-0.44%	-112 B 🔽
@sentry/browser - with treeshaking flags	24.04 kB	-0.43%	-102 B 🔽
@sentry/browser (incl. Tracing)	42.5 kB	-0.27%	-115 B 🔽
@sentry/browser (incl. Tracing, Profiling)	47.17 kB	-0.23%	-105 B 🔽
@sentry/browser (incl. Tracing, Replay)	81.31 kB	-0.14%	-109 B 🔽
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	70.88 kB	-0.17%	-116 B 🔽
@sentry/browser (incl. Tracing, Replay with Canvas)	86.01 kB	-0.13%	-110 B 🔽
@sentry/browser (incl. Tracing, Replay, Feedback)	98.27 kB	-0.11%	-104 B 🔽
@sentry/browser (incl. Feedback)	42.35 kB	-0.24%	-99 B 🔽
@sentry/browser (incl. sendFeedback)	30.2 kB	-0.37%	-110 B 🔽
@sentry/browser (incl. FeedbackAsync)	35.25 kB	-0.31%	-109 B 🔽
@sentry/browser (incl. Metrics)	26.81 kB	-0.43%	-114 B 🔽
@sentry/browser (incl. Logs)	26.95 kB	-0.43%	-116 B 🔽
@sentry/browser (incl. Metrics & Logs)	27.64 kB	-0.38%	-103 B 🔽
@sentry/react	27.3 kB	-0.34%	-93 B 🔽
@sentry/react (incl. Tracing)	44.86 kB	-0.21%	-91 B 🔽
@sentry/vue	29.99 kB	-0.32%	-94 B 🔽
@sentry/vue (incl. Tracing)	44.38 kB	-0.25%	-107 B 🔽
@sentry/svelte	25.55 kB	-0.45%	-115 B 🔽
CDN Bundle	28.2 kB	-0.27%	-74 B 🔽
CDN Bundle (incl. Tracing)	43.39 kB	-0.27%	-117 B 🔽
CDN Bundle (incl. Logs, Metrics)	29.07 kB	-0.26%	-75 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics)	44.26 kB	-0.23%	-99 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics)	68.12 kB	-0.14%	-90 B 🔽
CDN Bundle (incl. Tracing, Replay)	80.23 kB	-0.13%	-100 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	81.14 kB	-0.12%	-91 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback)	85.78 kB	-0.11%	-91 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	86.67 kB	-0.12%	-101 B 🔽
CDN Bundle - uncompressed	82.32 kB	-0.37%	-304 B 🔽
CDN Bundle (incl. Tracing) - uncompressed	128.25 kB	-0.25%	-315 B 🔽
CDN Bundle (incl. Logs, Metrics) - uncompressed	85.19 kB	-0.36%	-304 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	131.11 kB	-0.24%	-315 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	208.82 kB	-0.15%	-304 B 🔽
CDN Bundle (incl. Tracing, Replay) - uncompressed	245.1 kB	-0.13%	-315 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	247.95 kB	-0.13%	-315 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	258.01 kB	-0.13%	-315 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	260.85 kB	-0.13%	-315 B 🔽
@sentry/nextjs (client)	47.28 kB	-0.19%	-86 B 🔽
@sentry/sveltekit (client)	42.95 kB	-0.28%	-119 B 🔽
@sentry/node-core	56.28 kB	-0.12%	-63 B 🔽
@sentry/node	173.21 kB	+0.03%	+51 B 🔺
@sentry/node - without tracing	96.27 kB	-0.08%	-76 B 🔽
@sentry/aws-serverless	113.28 kB	-0.06%	-63 B 🔽

View base workflow run

github-actions · 2026-03-19T13:11:42Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,281	-	9,287	-0%
GET With Sentry	1,773	19%	1,616	+10%
GET With Sentry (error only)	6,105	66%	6,043	+1%
POST Baseline	1,212	-	1,158	+5%
POST With Sentry	605	50%	561	+8%
POST With Sentry (error only)	1,062	88%	1,037	+2%
MYSQL Baseline	3,309	-	3,205	+3%
MYSQL With Sentry	514	16%	409	+26%
MYSQL With Sentry (error only)	2,704	82%	2,591	+4%

View base workflow run

fix(deps): bump socket.io-parser to 4.2.6 to fixCVE-2026-33151
d9d9282
Fixes Dependabot alert #1223. Bumps socket.io-parser from 4.2.4 to 4.2.6 to address unbounded binary attachment memory exhaustion vulnerability. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chargome self-assigned this Mar 19, 2026

nicohrubec approved these changes Mar 19, 2026
View reviewed changes

chargome merged commit ccf337a into developMar 19, 2026
461 of 462 checks passed

chargome deleted the fix/dependabot-alert-1223 branch March 19, 2026 16:41

sentry-release-botBot mentioned this pull request Mar 25, 2026
publish: getsentry/sentry-javascript@10.46.0 getsentry/publish#7577
Closed
46 tasks

Navigation Menu

Uh oh!

Uh oh!

fix(deps): bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 - #19880

fix(deps): bump socket.io-parser to 4.2.6 to fix CVE-2026-33151#19880
chargome merged 1 commit into
developfrom
fix/dependabot-alert-1223

chargome commented Mar 19, 2026

Uh oh!

github-actionsBot commented Mar 19, 2026

New Features ✨

Bug Fixes 🐛

Deps

Other

Internal Changes 🔧

Uh oh!

github-actionsBot commented Mar 19, 2026

Uh oh!

github-actionsBot commented Mar 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

chargome commented Mar 19, 2026

Uh oh!

github-actionsBot commented Mar 19, 2026

Semver Impact of This PR

New Features ✨

Bug Fixes 🐛

Deps

Other

Internal Changes 🔧

Uh oh!

github-actionsBot commented Mar 19, 2026

size-limit report 📦

Uh oh!

github-actionsBot commented Mar 19, 2026

node-overhead report 🧳

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants