[Snyk] Upgrade socket.io from 4.5.0 to 4.7.5

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade socket.io from 4.5.0 to 4.7.5.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

- The recommended version is **14 versions** ahead of your current version. - The recommended version was released **25 days ago**, on 2024-03-14. The recommended version fixes: Severity | Issue | PriorityScore (*) | Exploit Maturity | :-------------------------:|:-------------------------|-------------------------|:-------------------------

| Denial of Service (DoS)
[SNYK-JS-ENGINEIO-3136336](https://snyk.io/vuln/SNYK-JS-ENGINEIO-3136336) | **375/1000**
**Why?** CVSS 7.5 | No Known Exploit

| Uncaught Exception
[SNYK-JS-ENGINEIO-5496331](https://snyk.io/vuln/SNYK-JS-ENGINEIO-5496331) | **375/1000**
**Why?** CVSS 7.5 | No Known Exploit

| Improper Input Validation
[SNYK-JS-SOCKETIOPARSER-3091012](https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012) | **375/1000**
**Why?** CVSS 7.5 | No Known Exploit

| Denial of Service (DoS)
[SNYK-JS-SOCKETIOPARSER-5596892](https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-5596892) | **375/1000**
**Why?** CVSS 7.5 | No Known Exploit

| Prototype Pollution
[SNYK-JS-XMLDOMXMLDOM-3042243](https://snyk.io/vuln/SNYK-JS-XMLDOMXMLDOM-3042243) | **375/1000**
**Why?** CVSS 7.5 | No Known Exploit

| Improper Input Validation
[SNYK-JS-XMLDOMXMLDOM-3092934](https://snyk.io/vuln/SNYK-JS-XMLDOMXMLDOM-3092934) | **375/1000**
**Why?** CVSS 7.5 | Proof of Concept (*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

4.7.5 - 2024-03-14
Bug Fixes
- close the adapters when the server is closed (bf64870)
- remove duplicate pipeline when serving bundle (e426f3e)
Links
- Diff: 4.7.4...4.7.5
- Client release: 4.7.5
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.4 - 2024-01-12
Bug Fixes
- typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914
Links
- Diff: 4.7.3...4.7.4
- Client release: 4.7.4
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.3 - 2024-01-03
Bug Fixes
- return the first response when broadcasting to a single socket (#4878) (df8e70f)
- typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)
Links
- Diff: 4.7.2...4.7.3
- Client release: 4.7.3
- engine.io@~6.5.2 (no change)
- ws@~8.11.0 (no change)
4.7.2 - 2023-08-02
Bug Fixes
- clean up child namespace when client is rejected in middleware (#4773) (0731c0d)
- webtransport: properly handle WebTransport-only connections (3468a19)
- webtransport: add proper framing (a306db0)
Links
- Diff: 4.7.1...4.7.2
- Client release: 4.7.2
- engine.io@~6.5.2 (diff)
- ws@~8.11.0 (no change)
4.7.1 - 2023-06-28
The client bundle contains a few fixes regarding the WebTransport support.

Links
- Diff: 4.7.0...4.7.1
- Client release: 4.7.1
- engine.io@~6.5.0 (no change)
- ws@~8.11.0 (no change)
```
  </li>
  <li>
    <b>4.7.0</b> - <a href="https://snyk.io/redirect/github/socketio/socket.io/releases/tag/4.7.0">2023-06-22</a></br><h3>Bug Fixes</h3>
```
- remove the Partial modifier from the socket.data type (#4740) (e5c62ca)
Features

Support for WebTransport

The Socket.IO server can now use WebTransport as the underlying transport.

WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

References:
Until WebTransport support lands in Node.js, you can use the @ fails-components/webtransport package:

<div class="highlight highlight-source-js notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="import { readFileSync } from "fs"; import { createServer } from "https"; import { Server } from "socket.io"; import { Http3Server } from "@ fails-components/webtransport";

// WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements) const cert = readFileSync("/path/to/my/cert.pem"); const key = readFileSync("/path/to/my/key.pem");

const httpsServer = createServer({ key, cert });

httpsServer.listen(3000);

const io = new Server(httpsServer, { transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default });

const h3Server = new Http3Server({ port: 3000, host: "0.0.0.0", secret: "changeit", cert, privKey: key, });

(async () => { const stream = await h3Server.sessionStream("/socket.io/"); const sessionReader = stream.getReader();

while (true) { const { done, value } = await sessionReader.read(); if (done) { break; } io.engine.onWebTransportSession(value); } })();

h3Server.startServer();">
```
import { readFileSync } from "fs";
import { createServer } from "https";
import { Server } from "socket.io";
import { Http3Server } from "@ fails-components/webtransport";
// WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)
const cert = readFileSync("/path/to/my/cert.pem");
const key = readFileSync("/path/to/my/key.pem");
const httpsServer = createServer({
key,
cert
});
httpsServer.listen(3000);
const io = new Server(httpsServer, {
transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
});
const h3Server = new Http3Server({
port: 3000,
host: "0.0.0.0",
secret: "changeit",
cert,
privKey: key,
});
(async () => {
const stream = await h3Server.sessionStream("/socket.io/");
const sessionReader = stream.getReader();
while (true) {
const { done, value } = await sessionReader.read();
if (done) {
break;
}
io.engine.onWebTransportSession(value);
}
})();
h3Server.startServer();
```

Client bundles with CORS headers

Links

connected on another Socket.IO server of the cluster, was lacking the
timeout() method.

<div class="highlight highlight-source-js notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="const sockets = await io.fetchSockets();

for (const socket of sockets) { if (someCondition) { socket.timeout(1000).emit("some-event", (err) => { if (err) { // the client did not acknowledge the event in the given delay } }); } }">

OrangeSodahub / CRLFnet