fix(deps): update dependency socket.io to v4.6.2 [security]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
socket.io (source)	`4.5.3` -> `4.6.2`

GitHub Vulnerability Alerts

CVE-2024-38355

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

node:events:502
    throw err; // Unhandled 'error' event
    ^

Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
    at new NodeError (node:internal/errors:405:5)
    at Socket.emit (node:events:500:17)
    at /myapp/node_modules/socket.io/lib/socket.js:531:14
    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
  code: 'ERR_UNHANDLED_ERROR',
  context: undefined
}

Affected versions

Version range	Needs minor update?
`4.6.2...latest`	Nothing to do
`3.0.0...4.6.1`	Please upgrade to `socket.io@4.6.2` (at least)
`2.3.0...2.5.0`	Please upgrade to `socket.io@2.5.1`

Patches

This issue is fixed by https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115, included in socket.io@4.6.2 (released in May 2023).

The fix was backported in the 2.x branch today: https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c

Workarounds

As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:

io.on("connection", (socket) => {
  socket.on("error", () => {
    // ...
  });
});

For more information

If you have any questions or comments about this advisory:

Open a discussion here

Thanks a lot to Paul Taylor for the responsible disclosure.

References

Release Notes

socketio/socket.io (socket.io)

### [`v4.6.2`](https://redirect.github.com/socketio/socket.io/releases/tag/4.6.2) [Compare Source](https://redirect.github.com/socketio/socket.io/compare/4.6.1...4.6.2) ##### Bug Fixes - **exports:** move `types` condition to the top ([#4698](https://redirect.github.com/socketio/socket.io/issues/4698)) ([3d44aae](https://redirect.github.com/socketio/socket.io/commit/3d44aae381af38349fdb808d510d9f47a0c2507e)) ##### Links - Diff: https://github.com/socketio/socket.io/compare/4.6.1...4.6.2 - Client release: [4.6.2](https://redirect.github.com/socketio/socket.io-client/releases/tag/4.6.2) - [`engine.io@~6.4.2`](https://redirect.github.com/socketio/engine.io/releases/tag/6.4.2) ([diff](https://redirect.github.com/socketio/engine.io/compare/6.4.1...6.4.2)) - [`ws@~8.11.0`](https://redirect.github.com/websockets/ws/releases/tag/8.11.0) (no change) ### [`v4.6.1`](https://redirect.github.com/socketio/socket.io/releases/tag/4.6.1) [Compare Source](https://redirect.github.com/socketio/socket.io/compare/4.6.0...4.6.1) ##### Bug Fixes - properly handle manually created dynamic namespaces ([0d0a7a2](https://redirect.github.com/socketio/socket.io/commit/0d0a7a22b5ff95f864216c529114b7dd41738d1e)) - **types:** fix nodenext module resolution compatibility ([#4625](https://redirect.github.com/socketio/socket.io/issues/4625)) ([d0b22c6](https://redirect.github.com/socketio/socket.io/commit/d0b22c630208669aceb7ae013180c99ef90279b0)) ##### Links - Diff: https://github.com/socketio/socket.io/compare/4.6.0...4.6.1 - Client release: [4.6.1](https://redirect.github.com/socketio/socket.io-client/releases/tag/4.6.1) - [`engine.io@~6.4.1`](https://redirect.github.com/socketio/engine.io/releases/tag/6.4.1) ([diff](https://redirect.github.com/socketio/engine.io/compare/6.4.0...6.4.1)) - [`ws@~8.11.0`](https://redirect.github.com/websockets/ws/releases/tag/8.11.0) (no change) ### [`v4.6.0`](https://redirect.github.com/socketio/socket.io/releases/tag/4.6.0) [Compare Source](https://redirect.github.com/socketio/socket.io/compare/4.5.4...4.6.0) ##### Bug Fixes - add timeout method to remote socket ([#4558](https://redirect.github.com/socketio/socket.io/issues/4558)) ([0c0eb00](https://redirect.github.com/socketio/socket.io/commit/0c0eb0016317218c2be3641e706cfaa9bea39a2d)) - **typings:** properly type emits with timeout ([f3ada7d](https://redirect.github.com/socketio/socket.io/commit/f3ada7d8ccc02eeced2b9b9ac8e4bc921eb630d2)) ##### Features ##### Promise-based acknowledgements This commit adds some syntactic sugar around acknowledgements: - `emitWithAck()` ```js try { const responses = await io.timeout(1000).emitWithAck("some-event"); console.log(responses); // one response per client } catch (e) { // some clients did not acknowledge the event in the given delay } io.on("connection", async (socket) => { // without timeout const response = await socket.emitWithAck("hello", "world"); // with a specific timeout try { const response = await socket.timeout(1000).emitWithAck("hello", "world"); } catch (err) { // the client did not acknowledge the event in the given delay } }); ``` - `serverSideEmitWithAck()` ```js try { const responses = await io.timeout(1000).serverSideEmitWithAck("some-event"); console.log(responses); // one response per server (except itself) } catch (e) { // some servers did not acknowledge the event in the given delay } ``` Added in [184f3cf](https://redirect.github.com/socketio/socket.io/commit/184f3cf7af57acc4b0948eee307f25f8536eb6c8). ##### Connection state recovery This feature allows a client to reconnect after a temporary disconnection and restore its state: - id - rooms - data - missed packets Usage: ```js import { Server } from "socket.io"; const io = new Server({ connectionStateRecovery: { // default values maxDisconnectionDuration: 2 * 60 * 1000, skipMiddlewares: true, }, }); io.on("connection", (socket) => { console.log(socket.recovered); // whether the state was recovered or not }); ``` Here's how it works: - the server sends a session ID during the handshake (which is different from the current `id` attribute, which is public and can be freely shared) - the server also includes an offset in each packet (added at the end of the data array, for backward compatibility) - upon temporary disconnection, the server stores the client state for a given delay (implemented at the adapter level) - upon reconnection, the client sends both the session ID and the last offset it has processed, and the server tries to restore the state The in-memory adapter already supports this feature, and we will soon update the Postgres and MongoDB adapters. We will also create a new adapter based on [Redis Streams](https://redis.io/docs/data-types/streams/), which will support this feature. Added in [54d5ee0](https://redirect.github.com/socketio/socket.io/commit/54d5ee05a684371191e207b8089f09fc24eb5107). ##### Compatibility (for real) with Express middlewares This feature implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle. Syntax: ```js io.engine.use((req, res, next) => { // do something next(); }); // with express-session import session from "express-session"; io.engine.use(session({ secret: "keyboard cat", resave: false, saveUninitialized: true, cookie: { secure: true } })); // with helmet import helmet from "helmet"; io.engine.use(helmet()); ``` A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too. Added in [24786e7](https://redirect.github.com/socketio/engine.io/commit/24786e77c5403b1c4b5a2bc84e2af06f9187f74a). ##### Error details in the disconnecting and disconnect events The `disconnect` event will now contain additional details about the disconnection reason. ```js io.on("connection", (socket) => { socket.on("disconnect", (reason, description) => { console.log(description); }); }); ``` Added in [8aa9499](https://redirect.github.com/socketio/socket.io/commit/8aa94991cee5518567d6254eec04b23f81510257). ##### Automatic removal of empty child namespaces This commit adds a new option, "cleanupEmptyChildNamespaces". With this option enabled (disabled by default), when a socket disconnects from a dynamic namespace and if there are no other sockets connected to it then the namespace will be cleaned up and its adapter will be closed. ```js import { createServer } from "node:http"; import { Server } from "socket.io"; const httpServer = createServer(); const io = new Server(httpServer, { cleanupEmptyChildNamespaces: true }); ``` Added in [5d9220b](https://redirect.github.com/socketio/socket.io/commit/5d9220b69adf73e086c27bbb63a4976b348f7c4c). ##### A new "addTrailingSlash" option The trailing slash which was added by default can now be disabled: ```js import { createServer } from "node:http"; import { Server } from "socket.io"; const httpServer = createServer(); const io = new Server(httpServer, { addTrailingSlash: false }); ``` In the example above, the clients can omit the trailing slash and use `/socket.io` instead of `/socket.io/`. Added in [d0fd474](https://redirect.github.com/socketio/engine.io/commit/d0fd4746afa396297f07bb62e539b0c1c4018d7c). ##### Performance Improvements - precompute the WebSocket frames when broadcasting ([da2b542](https://redirect.github.com/socketio/socket.io/commit/da2b54279749adc5279c9ac4742b01b36c01cff0)) ##### Links: - Diff: https://github.com/socketio/socket.io/compare/4.5.4...4.6.0 - Client release: [4.6.0](https://redirect.github.com/socketio/socket.io-client/releases/tag/4.6.0) - [`engine.io@~6.4.0`](https://redirect.github.com/socketio/engine.io/releases/tag/6.4.0) ([diff](https://redirect.github.com/socketio/engine.io/compare/6.2.0...6.2.1)) - [`ws@~8.11.0`](https://redirect.github.com/websockets/ws/releases/tag/8.11.0) ([diff](https://redirect.github.com/websockets/ws/compare/8.2.3...8.11.0)) ### [`v4.5.4`](https://redirect.github.com/socketio/socket.io/releases/tag/4.5.4) [Compare Source](https://redirect.github.com/socketio/socket.io/compare/4.5.3...4.5.4) This release contains a bump of: - `engine.io` in order to fix [CVE-2022-41940](https://redirect.github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w) - `socket.io-parser` in order to fix [CVE-2022-2421](https://redirect.github.com/advisories/GHSA-qm95-pgcg-qqfq). ##### Links: - Diff: https://github.com/socketio/socket.io/compare/4.5.3...4.5.4 - Client release: [4.5.4](https://redirect.github.com/socketio/socket.io-client/releases/tag/4.5.4) - [`engine.io@~6.2.1`](https://redirect.github.com/socketio/engine.io-client/tree/6.2.1) ([diff](https://redirect.github.com/socketio/engine.io/compare/6.2.0...6.2.1)) - [`ws@~8.2.3`](https://redirect.github.com/websockets/ws/releases/tag/8.2.3)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

RxCP / rxcp