add timeout method to remote socket (#4558) (0c0eb00)
typings: properly type emits with timeout (f3ada7d)
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
emitWithAck()
try {
const responses = await io.timeout(1000).emitWithAck("some-event");
console.log(responses); // one response per client
} catch (e) {
// some clients did not acknowledge the event in the given delay
}
io.on("connection", async (socket) => {
// without timeout
</tr></table>
This release contains 6e78489, which exports the BaseServer class in order to restore the compatibility with the nodenext module resolution strategy of TypeScript.
This commit implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
This release contains 6e78489, which exports the BaseServer class in order to restore the compatibility with the nodenext module resolution strategy of TypeScript.
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked
package source code to understand the potential risk. Ensure the package
is not malicious before proceeding. If you're unsure how to proceed, reach
out to your security team or ask the Socket team for help at support [AT]
socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all
Bumps the npm_and_yarn group with 19 updates in the / directory:
1.10.61.10.91.6.81.7.01.3.72.0.04.5.14.6.28.4.388.4.395.1.45.1.74.2.04.4.03.0.03.0.13.0.23.0.33.1.83.1.102.0.02.0.24.1.04.1.11.4.01.4.25.7.15.7.26.1.156.2.15.14.15.31.15.3.35.3.41.2.31.2.56.2.26.2.3Bumps the npm_and_yarn group with 8 updates in the /apps/docs directory:
4.18.24.19.28.4.278.4.397.22.87.24.73.0.23.0.31.15.21.15.65.19.25.31.15.3.35.3.47.5.97.5.10Updates
@grpc/grpc-jsfrom 1.10.6 to 1.10.9Release notes
Sourced from
@grpc/grpc-js's releases.Commits
674f4e3Merge pull request from GHSA-7v5v-9h63-cj867ecaa2dgrpc-js: Bump to 1.10.9e64d816grpc-js: Avoid buffering significantly more than max_receive_message_size per...45e5fe5Merge pull request #2750 from murgatroid99/grpc-js_idle_uds_fix87a3541grpc-js: Fix UDS channels not reconnecting after going idle3105791Merge pull request #2740 from sergiitk/backport-1.10-psm-interop-common-prod-...fec135aMerge pull request #2729 from sergiitk/psm-interop-common-prod-tests76fe802Merge pull request #2739 from murgatroid99/backport-1.10-grpc-js_linkify-it_fixd5edf49Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fix23c05fcMerge pull request #2732 from murgatroid99/grpc-js_proto-loader_updateUpdates
axiosfrom 1.6.8 to 1.7.0Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
3041c61[Release] v1.7.0 (#6408)18b13cbchore(docs): add fetch adapter docs; (#6407)e62099bfix(fetch): fixed a possible memory leak in the AbortController for the strea...b49aa8echore(release): v1.7.0-beta.2 (#6403)d57f03achore(ci): bump create-pull-request version to fix a bug; (#6405)097b0d1chore(ci): add tag resolution for npm releases based on package version; (#6404)870e0a7fix(fetch): fix headers getting from a stream response; (#6401)95a3e8efix(fetch): fix & optimize progress capturing for cases when the request data...ad3174afix(fetch): capitalize HTTP method names; (#6395)b9f4848chore(release): v1.7.0-beta.1 (#6383)Updates
quillfrom 1.3.7 to 2.0.0Release notes
Sourced from quill's releases.
... (truncated)
Changelog
Sourced from quill's changelog.
... (truncated)
Commits
a6638e92.0.0828d177Use stable version of Parchment0b383a42.0.0-rc.520f02f5Allow ref for insertBefore to be null1021587Expose Range type91a7346Expose Bounds type for getBounds()d5ac335Add support for v1 list attributes (#4082)aa26ff3Fix function overloads for formatText (#4086)bbbae912.0.0-rc.441bd1fcRemove empty .css.js files generated by bundlers (#4076)Maintainer changes
This version was pushed to npm by luin, a new releaser for quill since your current version.
Updates
socket.iofrom 4.5.1 to 4.6.2Release notes
Sourced from socket.io's releases.
... (truncated)
Changelog
Sourced from socket.io's changelog.
... (truncated)
Commits
faf914cchore(release): 4.6.215af22frefactor: add a noop handler for the error eventd365894chore: bump socket.io-parser to version 4.2.312b0de4chore: bump engine.io to version 6.4.23d44aaefix(exports): movetypescondition to the top (#4698)cbf0362docs(examples): bump dependencies for the private messaging example59280dadocs(examples): update examples to docker compose v250a4d37docs(changelog): add version of transitive dependencies6458b2bdocs(example): basic WebSocket-only clientb56da8adocs(examples): upgrade to React 18Updates
postcssfrom 8.4.38 to 8.4.39Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
e0efb16Release 8.4.39 version48304c5Update dependencies155ac57Merge pull request #1947 from romainmenke/fix-css-syntax-error-type--reliable...1b9b466fix CssSyntaxError type declaration3f4d96eUpdate dependenciesb952be7Update CI actionsb512b29Typof9a9868Move to pnpm 9 and Node.js 2279052c2Merge pull request #1940 from Xvezda/patch-10eedad4Update changed urlsUpdates
vitefrom 5.1.4 to 5.1.7Changelog
Sourced from vite's changelog.
Commits
e710c2frelease: v5.1.75a056ddfix:fs.denywith globs with directories (#16250)6f7466erelease: v5.1.6a862ecbchore(deps): update all non-major dependencies (#16131)8403546fix: server middleware mode resolve (#16122)b6fb323fix: check for publicDir before checking if it is a parent directory (#16046)fd9de04fix(esbuild): update tsconfck to fix bug that could cause a deadlock (#16124)f699194fix: handle function property extension in namespace import (#16113)0d2df52style(utils): remove null check (#16112)eef9da1fix(worker): throw error when circular worker import is detected and support ...Updates
@adobe/css-toolsfrom 4.2.0 to 4.4.0Changelog
Sourced from
@adobe/css-tools's changelog.Commits
Updates
@sideway/formulafrom 3.0.0 to 3.0.1Commits
5b44c1b3.0.19fbc20achore: better number regex41ae98eCleanupc59f35eMove to SidewayMaintainer changes
This version was pushed to npm by marsup, a new releaser for
@sideway/formulasince your current version.Updates
bracesfrom 3.0.2 to 3.0.3Commits
74b2db23.0.388f1429update eslint. lint, fix unit tests.415d660Snyk js braces 6838727 (#40)190510ffix tests, skip 1 test in test/braces.expand716eb9freadme bumpa5851e5Merge pull request #37 from coderaiser/fix/vulnerability2092bd1feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...9f5b4cffix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)98414f9remove funding file665ab5dupdate keepEscaping doc (#27)Updates
ejsfrom 3.1.8 to 3.1.10Release notes
Sourced from ejs's releases.
Commits
d3f807dVersion 3.1.109ee26ddMocha TDDe469741Basic pollution protection715e950Merge pull request #756 from Jeffrey-mu/maincabe314Include advanced usage examples29b076cAdded header11503c7Merge branch 'main' of github.com:mde/ejs into main7690404Added security banner to READMEf47d7aeUpdate SECURITY.md828cea1Update SECURITY.mdUpdates
engine.iofrom 6.2.1 to 6.4.2Release notes
Sourced from engine.io's releases.
... (truncated)
Changelog
Sourced from engine.io's changelog.
... (truncated)
Commits
95e2153chore(release): 6.4.2fc480b4fix: prevent crash when provided with an invalid query param0141951refactor(types): ensure compatibility with Express middlewares8b22162fix(uws): prevent crash when using with middlewares9395782fix: include error handling for Express middlewares (#674)911d0e3refactor: return HTTP 400 upon invalid request overlapbd6d471fix(typings): make clientsCount public (#675)7033c0echore(release): 6.4.16e78489refactor: export BaseServer class (#669)535b068docs: add upgrade event in the documentationUpdates
follow-redirectsfrom 1.15.1 to 1.15.6Commits
35a517cRelease version 1.15.6 of the npm package.c4f847fDrop Proxy-Authorization across hosts.8526b4aUse GitHub for disclosure.b1677ceRelease version 1.15.5 of the npm package.d8914f7Preserve fragment in responseUrl.6585820Release version 1.15.4 of the npm package.7a6567eDisallow bracketed hostnames.05629afPrefer native URL instead of deprecated url.parse.New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
00+30+20+10000+10000+100+1+200000+1+100+3+1000+10+10+1000+100000000+10+10+1+100+1000000000000000+1600+10000+10+6+4+6+5000+1+1+2+200000+50+2+70+3000+100+1+1+1+2+2+1+1+1+2+19+7+1+1+1+2+4+2+1+3+1+3+100+460+5000+1200000+6+5+14+17+1100+68+42🚮 Removed packages: npm/@babel/code-frame@7.23.5, npm/@babel/core@7.23.6, npm/@babel/generator@7.23.6, npm/@babel/helper-create-class-features-plugin@7.23.6, npm/@babel/helper-create-regexp-features-plugin@7.22.9, npm/@babel/helper-define-polyfill-provider@0.4.4, npm/@babel/helpers@7.23.6, npm/@babel/highlight@7.23.4, npm/@babel/parser@7.23.6, npm/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.23.3, npm/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.23.3, npm/@babel/plugin-syntax-import-assertions@7.23.3, npm/@babel/plugin-syntax-import-attributes@7.23.3, npm/@babel/plugin-syntax-typescript@7.23.3, npm/@babel/plugin-transform-arrow-functions@7.23.3, npm/@babel/plugin-transform-async-generator-functions@7.23.4, npm/@babel/plugin-transform-async-to-generator@7.23.3, npm/@babel/plugin-transform-block-scoped-functions@7.23.3, npm/@babel/plugin-transform-block-scoping@7.23.4, npm/@babel/plugin-transform-class-properties@7.23.3, npm/@babel/plugin-transform-class-static-block@7.23.4, npm/@babel/plugin-transform-classes@7.23.5, npm/@babel/plugin-transform-computed-properties@7.23.3, npm/@babel/plugin-transform-destructuring@7.23.3, npm/@babel/plugin-transform-dotall-regex@7.23.3, npm/@babel/plugin-transform-duplicate-keys@7.23.3, npm/@babel/plugin-transform-dynamic-import@7.23.4, npm/@babel/plugin-transform-exponentiation-operator@7.23.3, npm/@babel/plugin-transform-export-namespace-from@7.23.4, npm/@babel/plugin-transform-for-of@7.23.6, npm/@babel/plugin-transform-function-name@7.23.3, npm/@babel/plugin-transform-json-strings@7.23.4, npm/@babel/plugin-transform-literals@7.23.3, npm/@babel/plugin-transform-logical-assignment-operators@7.23.4, npm/@babel/plugin-transform-member-expression-literals@7.23.3, npm/@babel/plugin-transform-modules-amd@7.23.3, npm/@babel/plugin-transform-modules-commonjs@7.23.3, npm/@babel/plugin-transform-modules-systemjs@7.23.3, npm/@babel/plugin-transform-modules-umd@7.23.3, npm/@babel/plugin-transform-new-target@7.23.3, npm/@babel/plugin-transform-nullish-coalescing-operator@7.23.4, npm/@babel/plugin-transform-numeric-separator@7.23.4, npm/@babel/plugin-transform-object-rest-spread@7.23.4, npm/@babel/plugin-transform-object-super@7.23.3, npm/@babel/plugin-transform-optional-catch-binding@7.23.4, npm/@babel/plugin-transform-optional-chaining@7.23.4, npm/@babel/plugin-transform-parameters@7.23.3, npm/@babel/plugin-transform-private-methods@7.23.3, npm/@babel/plugin-transform-private-property-in-object@7.23.4, npm/@babel/plugin-transform-property-literals@7.23.3, npm/@babel/plugin-transform-react-display-name@7.23.3, npm/@babel/plugin-transform-react-pure-annotations@7.23.3, npm/@babel/plugin-transform-regenerator@7.23.3, npm/@babel/plugin-transform-reserved-words@7.23.3, npm/@babel/plugin-transform-shorthand-properties@7.23.3, npm/@babel/plugin-transform-spread@7.23.3, npm/@babel/plugin-transform-sticky-regex@7.23.3, npm/@babel/plugin-transform-template-literals@7.23.3, npm/@babel/plugin-transform-typeof-symbol@7.23.3, npm/@babel/plugin-transform-typescript@7.23.6, npm/@babel/plugin-transform-unicode-escapes@7.23.3, npm/@babel/plugin-transform-unicode-property-regex@7.23.3, npm/@babel/plugin-transform-unicode-regex@7.23.3, npm/@babel/plugin-transform-unicode-sets-regex@7.23.3, npm/@babel/preset-env@7.23.6, npm/@babel/preset-react@7.23.3, npm/@babel/preset-typescript@7.23.3, npm/@babel/runtime@7.23.6, npm/@babel/template@7.22.15, npm/@babel/traverse@7.22.8, npm/@babel/types@7.23.6, npm/@docusaurus/core@3.0.1, npm/@docusaurus/module-type-aliases@3.0.1, npm/@docusaurus/plugin-ideal-image@3.0.1, npm/@docusaurus/preset-classic@3.0.1, npm/@docusaurus/theme-search-algolia@3.0.1, npm/@docusaurus/tsconfig@3.0.1, npm/@docusaurus/types@3.0.1, npm/@jridgewell/gen-mapping@0.3.3, npm/@mdx-js/react@3.0.0, npm/@types/express-serve-static-core@4.17.35, npm/@types/express@4.17.17, npm/@types/istanbul-lib-coverage@2.0.4, npm/@types/json-schema@7.0.12, npm/@types/mdast@4.0.3, npm/@types/mime@1.3.2, npm/@types/react-router-config@5.0.7, npm/@types/react-router@5.1.20, npm/@types/serve-static@1.15.2, npm/@types/unist@3.0.2, npm/@webassemblyjs/ast@1.11.6, npm/@webassemblyjs/wasm-parser@1.11.6, npm/accepts@1.3.8, npm/acorn@8.11.2, npm/address@1.2.2, npm/ajv-keywords@3.5.2, npm/algoliasearch@4.22.0, npm/autoprefixer@10.4.16, npm/babel-plugin-polyfill-corejs2@0.4.7, npm/babel-plugin-polyfill-corejs3@0.8.7, npm/babel-plugin-polyfill-regenerator@0.5.4, npm/braces@3.0.2, npm/browserslist@4.22.2, npm/call-bind@1.0.2, npm/caniuse-lite@1.0.30001571, npm/chokidar@3.5.3, npm/clean-css@5.3.3, npm/clsx@2.0.0, npm/color-name@1.1.4, npm/convert-source-map@2.0.0, npm/css-tree@1.1.3, npm/css-what@6.1.0, npm/cssnano@5.1.15, npm/debug@4.3.4, npm/detect-libc@2.0.2, npm/devlop@1.1.0, npm/domelementtype@2.3.0, npm/domhandler@5.0.3, npm/domutils@3.1.0, npm/electron-to-chromium@1.4.616, npm/end-of-stream@1.4.4, npm/entities@4.5.0, npm/escape-html@1.0.3, npm/fast-deep-equal@3.1.3, npm/fast-fifo@1.3.2, npm/fast-glob@3.3.1, npm/fraction.js@4.3.7, npm/get-intrinsic@1.2.1, npm/glob-parent@5.1.2, npm/glob@7.2.3, npm/graceful-fs@4.2.11, npm/icss-utils@5.1.0, npm/ignore@5.2.4, npm/import-fresh@3.3.0, npm/inherits@2.0.4, npm/ini@1.3.8, npm/is-docker@2.2.1, npm/is-glob@4.0.3, npm/jiti@1.21.0, npm/js-tokens@4.0.0, npm/json-parse-even-better-errors@2.3.1, npm/json5@2.2.3, npm/kind-of@6.0.3, npm/lodash@4.17.21, npm/loose-envify@1.4.0, npm/mdast-util-find-and-replace@3.0.1, npm/memfs@3.6.0, npm/merge2@1.4.1, npm/micromark-util-character@1.2.0, npm/micromark-util-symbol@1.1.0, npm/micromatch@4.0.5, npm/mime-types@2.1.18, npm/minimist@1.2.8, npm/mkdirp-classic@0.5.3, npm/nanoid@3.3.7, npm/node-releases@2.0.14, npm/normalize-path@3.0.0, npm/obuf@1.1.2, npm/once@1.4.0, npm/open@8.4.2, npm/parseurl@1.3.3, npm/picomatch@2.3.1, npm/postcss-selector-parser@6.0.13, npm/postcss-value-parser@4.2.0, npm/postcss@8.4.32, npm/prism-react-renderer@2.3.1, npm/prop-types@15.8.1
View full report↗︎
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
node install.jsnode install.jsnode scripts/postinstall.jspackage.jsonnode scripts/postinstall.jsView full report↗︎
Next steps
What is an install script?
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with
@SocketSecurity ignorefollowed by a space separated list ofecosystem/package-name@versionspecifiers. e.g.@SocketSecurity ignore npm/foo@1.0.0or ignore all packages with@SocketSecurity ignore-all@SocketSecurity ignore npm/esbuild@0.17.19@SocketSecurity ignore npm/esbuild@0.18.20@SocketSecurity ignore npm/@prisma/client@5.9.1@SocketSecurity ignore npm/@prisma/engines@5.9.1Superseded by #979.