search

aurelia / framework

The Aurelia 1 framework entry point, bringing together all the required sub-modules of Aurelia.
MIT License
11.76k stars 623 forks source link

build(deps): bump engine.io and socket.io #1005

Open dependabot[bot] opened 2 years ago

dependabot[bot] commented 2 years ago

Bumps engine.io and socket.io. These dependencies needed to be updated together. Updates engine.io from 6.1.3 to 6.2.1

Release notes

Sourced from engine.io's releases.

6.2.1

:warning: This release contains an important security fix :warning:

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

Error: read ECONNRESET
    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  errno: -104,
  code: 'ECONNRESET',
  syscall: 'read'
}

Please upgrade as soon as possible.

Bug Fixes

  • catch errors when destroying invalid upgrades (#658) (425e833)

6.2.0

Features

  • add the "maxPayload" field in the handshake details (088dcb4)

So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize value.

This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as we only add a field in the JSON-encoded handshake data:

0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links

Changelog

Sourced from engine.io's changelog.

6.2.1 (2022-11-20)

:warning: This release contains an important security fix :warning:

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

Error: read ECONNRESET
    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  errno: -104,
  code: 'ECONNRESET',
  syscall: 'read'
}

Please upgrade as soon as possible.

Bug Fixes

  • catch errors when destroying invalid upgrades (#658) (425e833)

3.6.0 (2022-06-06)

Bug Fixes

Features

  • decrease the default value of maxHttpBufferSize (58e274c)

This change reduces the default value from 100 mb to a more sane 1 mb.

This helps protect the server against denial of service attacks by malicious clients sending huge amounts of data.

See also: https://github.com/advisories/GHSA-j4f2-536g-r55m

  • increase the default value of pingTimeout (f55a79a)

... (truncated)

Commits
  • 24b847b chore(release): 6.2.1
  • 425e833 fix: catch errors when destroying invalid upgrades (#658)
  • 99adb00 chore(deps): bump xmlhttprequest-ssl and engine.io-client in /examples/latenc...
  • d196f6a chore(deps): bump minimatch from 3.0.4 to 3.1.2 (#660)
  • 7c1270f chore(deps): bump nanoid from 3.1.25 to 3.3.1 (#659)
  • 535a01d ci: add Node.js 18 in the test matrix
  • 1b71a6f docs: remove "Vanilla JS" highlight from README (#656)
  • 917d1d2 refactor: replace deprecated String.prototype.substr() (#646)
  • 020801a chore: add changelog for version 3.6.0
  • ed1d6f9 test: make test script work on Windows (#643)
  • Additional commits viewable in compare view


Updates socket.io from 4.4.1 to 4.5.3

Release notes

Sourced from socket.io's releases.

4.5.3

Bug Fixes

  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)

Links:

4.5.2

Bug Fixes

  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)

Links:

4.5.1

Bug Fixes

  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#4351) (9b43c91)

Links:

4.5.0

Bug Fixes

  • typings: ensure compatibility with TypeScript 3.x (#4259) (02c87a8)

Features

  • add support for catch-all listeners for outgoing packets (531104d)

This is similar to onAny(), but for outgoing packets.

... (truncated)

Changelog

Sourced from socket.io's changelog.

4.5.3 (2022-10-15)

Bug Fixes

  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)

4.5.2 (2022-09-02)

Bug Fixes

  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)

2.5.0 (2022-06-26)

Bug Fixes

  • fix race condition in dynamic namespaces (05e1278)
  • ignore packet received after disconnection (22d4bdf)
  • only set 'connected' to true after middleware execution (226cc16)
  • prevent the socket from joining a room after disconnection (f223178)

4.5.1 (2022-05-17)

Bug Fixes

  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#4351) (9b43c91)

4.5.0 (2022-04-23)

Bug Fixes

  • typings: ensure compatibility with TypeScript 3.x (#4259) (02c87a8)

... (truncated)

Commits
  • 945c84b chore(release): 4.5.3
  • d3d0a2d fix(typings): accept an HTTP2 server in the constructor
  • 19b225b docs(examples): update dependencies of the basic CRUD example
  • 8fae95d docs: add jsdoc for each public method
  • e6f6b90 docs: add deprecation notice for the allSockets() method
  • 596eb88 ci: upgrade to actions/checkout@3 and actions/setup-node@3
  • e357daf fix(typings): apply types to "io.timeout(...).emit()" calls
  • 10fa4a2 refactor: add list of possible disconnection reasons
  • 8be95b3 chore(release): 4.5.2
  • ba497ee fix(uws): prevent the server from crashing after upgrade
  • Additional commits viewable in compare view


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aurelia/framework/network/alerts).