Bump socket.io from 1.4.5 to 2.4.0

Open dependabot[bot] opened this issue 1 year ago • 0 comments

Bumps socket.io from 1.4.5 to 2.4.0.

Release notes

2.4.0

Related blog post: https://socket.io/blog/socket-io-2-4-0/

Features (from Engine.IO)

add support for all cookie options (19cc582)

disable perMessageDeflate by default (5ad2736)

Bug Fixes

security: do not allow all origins by default (f78a575)

properly overwrite the query sent in the handshake (d33a619)

:warning: BREAKING CHANGE :warning:

Previously, CORS was enabled by default, which meant that a Socket.IO server sent the necessary CORS headers (Access-Control-Allow-xxx) to any domain. This will not be the case anymore, and you now have to explicitly enable it.

Please note that you are not impacted if:

you are using Socket.IO v2 and the origins option to restrict the list of allowed domains

you are using Socket.IO v3 (disabled by default)

This commit also removes the support for '*' matchers and protocol-less URL:
io.origins('https://example.com:443'); => io.origins(['https://example.com']);
io.origins('localhost:3000');          => io.origins(['http://localhost:3000']);
io.origins('http://localhost:*');      => io.origins(['http://localhost:3000']);
io.origins('*:3000');                  => io.origins(['http://localhost:3000']);
To restore the previous behavior (please use with caution):
io.origins((_, callback) => {
  callback(null, true);
});
See also:

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

https://socket.io/docs/v3/handling-cors/

https://socket.io/docs/v3/migrating-from-2-x-to-3-0/#CORS-handling

Thanks a lot to @ni8walk3r for the security report.

Links:

... (truncated)

Changelog

Sourced from socket.io's changelog.

2.4.0 (2021-01-04)

Bug Fixes

security: do not allow all origins by default (f78a575)

properly overwrite the query sent in the handshake (d33a619)

3.0.4 (2020-12-07)

3.0.3 (2020-11-19)

3.0.2 (2020-11-17)

Bug Fixes

merge Engine.IO options (43705d7)

3.0.1 (2020-11-09)

Bug Fixes

export ServerOptions and Namespace types (#3684) (f62f180)

typings: update the signature of the emit method (50671d9)

3.0.0 (2020-11-05)

Bug Fixes

close clients with no namespace (91cd255)

Features

emit an Error object upon middleware error (54bf4a4)

serve msgpack bundle (aa7574f)

add support for catch-all listeners (5c73733)

make Socket#join() and Socket#leave() synchronous (129c641)

remove prod dependency to socket.io-client (7603da7)

move binary detection back to the parser (669592d)

add ES6 module export (8b6b100)

do not reuse the Engine.IO id (2875d2c)

remove Server#set() method (029f478)

... (truncated)

Commits

873fdc5 chore(release): 2.4.0
f78a575 fix(security): do not allow all origins by default
d33a619 fix: properly overwrite the query sent in the handshake
3951a79 chore: bump engine.io version
6fa026f ci: migrate to GitHub Actions
47161a6 [chore] Release 2.3.0
cf39362 [chore] Bump socket.io-parser to version 3.4.0
4d01b2c test: remove deprecated Buffer usage (#3481)
8227192 [docs] Fix the default value of the 'origins' parameter (#3464)
1150eb5 [chore] Bump engine.io to version 3.4.0
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by darrachequesne, a new releaser for socket.io since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

Mar 25 '24 23:03 dependabot[bot]