Bump engine.io from 6.2.0 to 6.3.1

[dependabot[bot]]

Bumps engine.io from 6.2.0 to 6.3.1.

Release notes

Sourced from engine.io's releases.

6.3.0

Bug Fixes

• fix the ES module wrapper (ed87609)
• wait for all packets to be sent before closing the WebSocket connection (a65a047)

Features

• add the "addTrailingSlash" option (#655) (d0fd474)

The trailing slash which was added by default can now be disabled:

import { Server } from "engine.io";
const server = new Server();
server.attach(httpServer, {
addTrailingSlash: false
});

In the example above, the clients can omit the trailing slash and use /engine.io instead of /engine.io/.

Performance Improvements

• add the wsPreEncodedFrame option (5e34722)

This will be used when broadcasting packets at the Socket.IO level.

See also: https://github.com/socketio/socket.io-adapter/commit/5f7b47d40f9daabe4e3c321eda620bbadfe5ce96

Links

• Diff: https://github.com/socketio/engine.io/compare/6.2.1...6.3.0
• Client release: 6.3.0
• ws version: ~8.11.0 (diff)

6.2.1

:warning: This release contains an important security fix :warning:

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

Error: read ECONNRESET
    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
</tr></table> 

... (truncated)

Changelog

Sourced from engine.io's changelog.

6.3.1 (2023-01-12)

6.3.0 (2023-01-10)

Bug Fixes

• fix the ES module wrapper (ed87609)
• wait for all packets to be sent before closing the WebSocket connection (a65a047)

Features

• add the "addTrailingSlash" option (#655) (d0fd474)

The trailing slash which was added by default can now be disabled:

import { Server } from "engine.io";
const server = new Server();
server.attach(httpServer, {
addTrailingSlash: false
});

In the example above, the clients can omit the trailing slash and use /engine.io instead of /engine.io/.

Performance Improvements

• add the wsPreEncodedFrame option (5e34722)

This will be used when broadcasting packets at the Socket.IO level.

See also: https://github.com/socketio/socket.io-adapter/commit/5f7b47d40f9daabe4e3c321eda620bbadfe5ce96

Dependencies

• ws@~8.11.0 (diff)

3.6.1 (2022-11-20)

:warning: This release contains an important security fix :warning:

... (truncated)

Commits

• 4d6f454 chore(release): 6.3.1
• 69603b9 refactor: make the compress option optional
• ae1ea77 chore(release): 6.3.0
• a65a047 fix: wait for all packets to be sent before closing the WebSocket connection
• ed87609 fix: fix the ES module wrapper
• bc98bf1 refactor: bump prettier to version 2.8.1
• 33dc073 docs: add some TODOs for the next major release
• d0fd474 feat: add the "addTrailingSlash" option (#655)
• 5e34722 perf: add the wsPreEncodedFrame option
• 8a937a4 chore(deps): bump qs and express in /examples/latency (#665)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot[bot]]

Superseded by #378.