add timeout method to remote socket (#4558) (0c0eb00)
typings: properly type emits with timeout (f3ada7d)
Features
Promise-based acknowledgements
This commit adds some syntactic sugar around acknowledgements:
emitWithAck()
try {
const responses = await io.timeout(1000).emitWithAck("some-event");
console.log(responses); // one response per client
} catch (e) {
// some clients did not acknowledge the event in the given delay
}
io.on("connection", async (socket) => {
// without timeout
</tr></table>
This release contains 6e78489, which exports the BaseServer class in order to restore the compatibility with the nodenext module resolution strategy of TypeScript.
This commit implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.
This release contains 6e78489, which exports the BaseServer class in order to restore the compatibility with the nodenext module resolution strategy of TypeScript.
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked
package source code to understand the potential risk. Ensure the package
is not malicious before proceeding. If you're unsure how to proceed, reach
out to your security team or ask the Socket team for help at support [AT]
socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all
Bumps the npm_and_yarn group with 19 updates in the / directory:
1.10.6
1.10.9
1.6.8
1.7.0
1.3.7
2.0.0
4.5.1
4.6.2
8.4.38
8.4.39
5.1.4
5.1.7
4.2.0
4.4.0
3.0.0
3.0.1
3.0.2
3.0.3
3.1.8
3.1.10
2.0.0
2.0.2
4.1.0
4.1.1
1.4.0
1.4.2
5.7.1
5.7.2
6.1.15
6.2.1
5.14.1
5.31.1
5.3.3
5.3.4
1.2.3
1.2.5
6.2.2
6.2.3
Bumps the npm_and_yarn group with 8 updates in the /apps/docs directory:
4.18.2
4.19.2
8.4.27
8.4.39
7.22.8
7.24.7
3.0.2
3.0.3
1.15.2
1.15.6
5.19.2
5.31.1
5.3.3
5.3.4
7.5.9
7.5.10
Updates
@grpc/grpc-js
from 1.10.6 to 1.10.9Release notes
Sourced from
@grpc/grpc-js
's releases.Commits
674f4e3
Merge pull request from GHSA-7v5v-9h63-cj867ecaa2d
grpc-js: Bump to 1.10.9e64d816
grpc-js: Avoid buffering significantly more than max_receive_message_size per...45e5fe5
Merge pull request #2750 from murgatroid99/grpc-js_idle_uds_fix87a3541
grpc-js: Fix UDS channels not reconnecting after going idle3105791
Merge pull request #2740 from sergiitk/backport-1.10-psm-interop-common-prod-...fec135a
Merge pull request #2729 from sergiitk/psm-interop-common-prod-tests76fe802
Merge pull request #2739 from murgatroid99/backport-1.10-grpc-js_linkify-it_fixd5edf49
Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fix23c05fc
Merge pull request #2732 from murgatroid99/grpc-js_proto-loader_updateUpdates
axios
from 1.6.8 to 1.7.0Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
3041c61
[Release] v1.7.0 (#6408)18b13cb
chore(docs): add fetch adapter docs; (#6407)e62099b
fix(fetch): fixed a possible memory leak in the AbortController for the strea...b49aa8e
chore(release): v1.7.0-beta.2 (#6403)d57f03a
chore(ci): bump create-pull-request version to fix a bug; (#6405)097b0d1
chore(ci): add tag resolution for npm releases based on package version; (#6404)870e0a7
fix(fetch): fix headers getting from a stream response; (#6401)95a3e8e
fix(fetch): fix & optimize progress capturing for cases when the request data...ad3174a
fix(fetch): capitalize HTTP method names; (#6395)b9f4848
chore(release): v1.7.0-beta.1 (#6383)Updates
quill
from 1.3.7 to 2.0.0Release notes
Sourced from quill's releases.
... (truncated)
Changelog
Sourced from quill's changelog.
... (truncated)
Commits
a6638e9
2.0.0828d177
Use stable version of Parchment0b383a4
2.0.0-rc.520f02f5
Allow ref for insertBefore to be null1021587
Expose Range type91a7346
Expose Bounds type for getBounds()d5ac335
Add support for v1 list attributes (#4082)aa26ff3
Fix function overloads for formatText (#4086)bbbae91
2.0.0-rc.441bd1fc
Remove empty .css.js files generated by bundlers (#4076)Maintainer changes
This version was pushed to npm by luin, a new releaser for quill since your current version.
Updates
socket.io
from 4.5.1 to 4.6.2Release notes
Sourced from socket.io's releases.
... (truncated)
Changelog
Sourced from socket.io's changelog.
... (truncated)
Commits
faf914c
chore(release): 4.6.215af22f
refactor: add a noop handler for the error eventd365894
chore: bump socket.io-parser to version 4.2.312b0de4
chore: bump engine.io to version 6.4.23d44aae
fix(exports): movetypes
condition to the top (#4698)cbf0362
docs(examples): bump dependencies for the private messaging example59280da
docs(examples): update examples to docker compose v250a4d37
docs(changelog): add version of transitive dependencies6458b2b
docs(example): basic WebSocket-only clientb56da8a
docs(examples): upgrade to React 18Updates
postcss
from 8.4.38 to 8.4.39Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
e0efb16
Release 8.4.39 version48304c5
Update dependencies155ac57
Merge pull request #1947 from romainmenke/fix-css-syntax-error-type--reliable...1b9b466
fix CssSyntaxError type declaration3f4d96e
Update dependenciesb952be7
Update CI actionsb512b29
Typof9a9868
Move to pnpm 9 and Node.js 2279052c2
Merge pull request #1940 from Xvezda/patch-10eedad4
Update changed urlsUpdates
vite
from 5.1.4 to 5.1.7Changelog
Sourced from vite's changelog.
Commits
e710c2f
release: v5.1.75a056dd
fix:fs.deny
with globs with directories (#16250)6f7466e
release: v5.1.6a862ecb
chore(deps): update all non-major dependencies (#16131)8403546
fix: server middleware mode resolve (#16122)b6fb323
fix: check for publicDir before checking if it is a parent directory (#16046)fd9de04
fix(esbuild): update tsconfck to fix bug that could cause a deadlock (#16124)f699194
fix: handle function property extension in namespace import (#16113)0d2df52
style(utils): remove null check (#16112)eef9da1
fix(worker): throw error when circular worker import is detected and support ...Updates
@adobe/css-tools
from 4.2.0 to 4.4.0Changelog
Sourced from
@adobe/css-tools
's changelog.Commits
Updates
@sideway/formula
from 3.0.0 to 3.0.1Commits
5b44c1b
3.0.19fbc20a
chore: better number regex41ae98e
Cleanupc59f35e
Move to SidewayMaintainer changes
This version was pushed to npm by marsup, a new releaser for
@sideway/formula
since your current version.Updates
braces
from 3.0.2 to 3.0.3Commits
74b2db2
3.0.388f1429
update eslint. lint, fix unit tests.415d660
Snyk js braces 6838727 (#40)190510f
fix tests, skip 1 test in test/braces.expand716eb9f
readme bumpa5851e5
Merge pull request #37 from coderaiser/fix/vulnerability2092bd1
feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...9f5b4cf
fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)98414f9
remove funding file665ab5d
update keepEscaping doc (#27)Updates
ejs
from 3.1.8 to 3.1.10Release notes
Sourced from ejs's releases.
Commits
d3f807d
Version 3.1.109ee26dd
Mocha TDDe469741
Basic pollution protection715e950
Merge pull request #756 from Jeffrey-mu/maincabe314
Include advanced usage examples29b076c
Added header11503c7
Merge branch 'main' of github.com:mde/ejs into main7690404
Added security banner to READMEf47d7ae
Update SECURITY.md828cea1
Update SECURITY.mdUpdates
engine.io
from 6.2.1 to 6.4.2Release notes
Sourced from engine.io's releases.
... (truncated)
Changelog
Sourced from engine.io's changelog.
... (truncated)
Commits
95e2153
chore(release): 6.4.2fc480b4
fix: prevent crash when provided with an invalid query param0141951
refactor(types): ensure compatibility with Express middlewares8b22162
fix(uws): prevent crash when using with middlewares9395782
fix: include error handling for Express middlewares (#674)911d0e3
refactor: return HTTP 400 upon invalid request overlapbd6d471
fix(typings): make clientsCount public (#675)7033c0e
chore(release): 6.4.16e78489
refactor: export BaseServer class (#669)535b068
docs: add upgrade event in the documentationUpdates
follow-redirects
from 1.15.1 to 1.15.6Commits
35a517c
Release version 1.15.6 of the npm package.c4f847f
Drop Proxy-Authorization across hosts.8526b4a
Use GitHub for disclosure.b1677ce
Release version 1.15.5 of the npm package.d8914f7
Preserve fragment in responseUrl.6585820
Release version 1.15.4 of the npm package.7a6567e
Disallow bracketed hostnames.05629af
Prefer native URL instead of deprecated url.parse.New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
0
0
+3
0
+2
0
+1
0
0
0
0
+1
0
0
0
0
+1
0
0
+1
+2
0
0
0
0
0
+1
+1
0
0
+3
+1
0
0
0
+1
0
+1
0
+1
0
0
0
+1
0
0
0
0
0
0
0
0
+1
0
+1
0
+1
+1
0
0
+1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
+16
0
0
+1
0
0
0
0
+1
0
+6
+4
+6
+5
0
0
0
+1
+1
+2
+2
0
0
0
0
0
+5
0
+2
+7
0
+3
0
0
0
+1
0
0
+1
+1
+1
+2
+2
+1
+1
+1
+2
+19
+7
+1
+1
+1
+2
+4
+2
+1
+3
+1
+3
+1
0
0
+46
0
+5
0
0
0
+12
0
0
0
0
0
+6
+5
+14
+17
+11
0
0
+68
+42
🚮 Removed packages: npm/@babel/code-frame@7.23.5, npm/@babel/core@7.23.6, npm/@babel/generator@7.23.6, npm/@babel/helper-create-class-features-plugin@7.23.6, npm/@babel/helper-create-regexp-features-plugin@7.22.9, npm/@babel/helper-define-polyfill-provider@0.4.4, npm/@babel/helpers@7.23.6, npm/@babel/highlight@7.23.4, npm/@babel/parser@7.23.6, npm/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.23.3, npm/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.23.3, npm/@babel/plugin-syntax-import-assertions@7.23.3, npm/@babel/plugin-syntax-import-attributes@7.23.3, npm/@babel/plugin-syntax-typescript@7.23.3, npm/@babel/plugin-transform-arrow-functions@7.23.3, npm/@babel/plugin-transform-async-generator-functions@7.23.4, npm/@babel/plugin-transform-async-to-generator@7.23.3, npm/@babel/plugin-transform-block-scoped-functions@7.23.3, npm/@babel/plugin-transform-block-scoping@7.23.4, npm/@babel/plugin-transform-class-properties@7.23.3, npm/@babel/plugin-transform-class-static-block@7.23.4, npm/@babel/plugin-transform-classes@7.23.5, npm/@babel/plugin-transform-computed-properties@7.23.3, npm/@babel/plugin-transform-destructuring@7.23.3, npm/@babel/plugin-transform-dotall-regex@7.23.3, npm/@babel/plugin-transform-duplicate-keys@7.23.3, npm/@babel/plugin-transform-dynamic-import@7.23.4, npm/@babel/plugin-transform-exponentiation-operator@7.23.3, npm/@babel/plugin-transform-export-namespace-from@7.23.4, npm/@babel/plugin-transform-for-of@7.23.6, npm/@babel/plugin-transform-function-name@7.23.3, npm/@babel/plugin-transform-json-strings@7.23.4, npm/@babel/plugin-transform-literals@7.23.3, npm/@babel/plugin-transform-logical-assignment-operators@7.23.4, npm/@babel/plugin-transform-member-expression-literals@7.23.3, npm/@babel/plugin-transform-modules-amd@7.23.3, npm/@babel/plugin-transform-modules-commonjs@7.23.3, npm/@babel/plugin-transform-modules-systemjs@7.23.3, npm/@babel/plugin-transform-modules-umd@7.23.3, npm/@babel/plugin-transform-new-target@7.23.3, npm/@babel/plugin-transform-nullish-coalescing-operator@7.23.4, npm/@babel/plugin-transform-numeric-separator@7.23.4, npm/@babel/plugin-transform-object-rest-spread@7.23.4, npm/@babel/plugin-transform-object-super@7.23.3, npm/@babel/plugin-transform-optional-catch-binding@7.23.4, npm/@babel/plugin-transform-optional-chaining@7.23.4, npm/@babel/plugin-transform-parameters@7.23.3, npm/@babel/plugin-transform-private-methods@7.23.3, npm/@babel/plugin-transform-private-property-in-object@7.23.4, npm/@babel/plugin-transform-property-literals@7.23.3, npm/@babel/plugin-transform-react-display-name@7.23.3, npm/@babel/plugin-transform-react-pure-annotations@7.23.3, npm/@babel/plugin-transform-regenerator@7.23.3, npm/@babel/plugin-transform-reserved-words@7.23.3, npm/@babel/plugin-transform-shorthand-properties@7.23.3, npm/@babel/plugin-transform-spread@7.23.3, npm/@babel/plugin-transform-sticky-regex@7.23.3, npm/@babel/plugin-transform-template-literals@7.23.3, npm/@babel/plugin-transform-typeof-symbol@7.23.3, npm/@babel/plugin-transform-typescript@7.23.6, npm/@babel/plugin-transform-unicode-escapes@7.23.3, npm/@babel/plugin-transform-unicode-property-regex@7.23.3, npm/@babel/plugin-transform-unicode-regex@7.23.3, npm/@babel/plugin-transform-unicode-sets-regex@7.23.3, npm/@babel/preset-env@7.23.6, npm/@babel/preset-react@7.23.3, npm/@babel/preset-typescript@7.23.3, npm/@babel/runtime@7.23.6, npm/@babel/template@7.22.15, npm/@babel/traverse@7.22.8, npm/@babel/types@7.23.6, npm/@docusaurus/core@3.0.1, npm/@docusaurus/module-type-aliases@3.0.1, npm/@docusaurus/plugin-ideal-image@3.0.1, npm/@docusaurus/preset-classic@3.0.1, npm/@docusaurus/theme-search-algolia@3.0.1, npm/@docusaurus/tsconfig@3.0.1, npm/@docusaurus/types@3.0.1, npm/@jridgewell/gen-mapping@0.3.3, npm/@mdx-js/react@3.0.0, npm/@types/express-serve-static-core@4.17.35, npm/@types/express@4.17.17, npm/@types/istanbul-lib-coverage@2.0.4, npm/@types/json-schema@7.0.12, npm/@types/mdast@4.0.3, npm/@types/mime@1.3.2, npm/@types/react-router-config@5.0.7, npm/@types/react-router@5.1.20, npm/@types/serve-static@1.15.2, npm/@types/unist@3.0.2, npm/@webassemblyjs/ast@1.11.6, npm/@webassemblyjs/wasm-parser@1.11.6, npm/accepts@1.3.8, npm/acorn@8.11.2, npm/address@1.2.2, npm/ajv-keywords@3.5.2, npm/algoliasearch@4.22.0, npm/autoprefixer@10.4.16, npm/babel-plugin-polyfill-corejs2@0.4.7, npm/babel-plugin-polyfill-corejs3@0.8.7, npm/babel-plugin-polyfill-regenerator@0.5.4, npm/braces@3.0.2, npm/browserslist@4.22.2, npm/call-bind@1.0.2, npm/caniuse-lite@1.0.30001571, npm/chokidar@3.5.3, npm/clean-css@5.3.3, npm/clsx@2.0.0, npm/color-name@1.1.4, npm/convert-source-map@2.0.0, npm/css-tree@1.1.3, npm/css-what@6.1.0, npm/cssnano@5.1.15, npm/debug@4.3.4, npm/detect-libc@2.0.2, npm/devlop@1.1.0, npm/domelementtype@2.3.0, npm/domhandler@5.0.3, npm/domutils@3.1.0, npm/electron-to-chromium@1.4.616, npm/end-of-stream@1.4.4, npm/entities@4.5.0, npm/escape-html@1.0.3, npm/fast-deep-equal@3.1.3, npm/fast-fifo@1.3.2, npm/fast-glob@3.3.1, npm/fraction.js@4.3.7, npm/get-intrinsic@1.2.1, npm/glob-parent@5.1.2, npm/glob@7.2.3, npm/graceful-fs@4.2.11, npm/icss-utils@5.1.0, npm/ignore@5.2.4, npm/import-fresh@3.3.0, npm/inherits@2.0.4, npm/ini@1.3.8, npm/is-docker@2.2.1, npm/is-glob@4.0.3, npm/jiti@1.21.0, npm/js-tokens@4.0.0, npm/json-parse-even-better-errors@2.3.1, npm/json5@2.2.3, npm/kind-of@6.0.3, npm/lodash@4.17.21, npm/loose-envify@1.4.0, npm/mdast-util-find-and-replace@3.0.1, npm/memfs@3.6.0, npm/merge2@1.4.1, npm/micromark-util-character@1.2.0, npm/micromark-util-symbol@1.1.0, npm/micromatch@4.0.5, npm/mime-types@2.1.18, npm/minimist@1.2.8, npm/mkdirp-classic@0.5.3, npm/nanoid@3.3.7, npm/node-releases@2.0.14, npm/normalize-path@3.0.0, npm/obuf@1.1.2, npm/once@1.4.0, npm/open@8.4.2, npm/parseurl@1.3.3, npm/picomatch@2.3.1, npm/postcss-selector-parser@6.0.13, npm/postcss-value-parser@4.2.0, npm/postcss@8.4.32, npm/prism-react-renderer@2.3.1, npm/prop-types@15.8.1
View full report↗︎
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
node install.js
node install.js
node scripts/postinstall.js
package.json
node scripts/postinstall.js
View full report↗︎
Next steps
What is an install script?
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with
@SocketSecurity ignore
followed by a space separated list ofecosystem/package-name@version
specifiers. e.g.@SocketSecurity ignore npm/foo@1.0.0
or ignore all packages with@SocketSecurity ignore-all
@SocketSecurity ignore npm/esbuild@0.17.19
@SocketSecurity ignore npm/esbuild@0.18.20
@SocketSecurity ignore npm/@prisma/client@5.9.1
@SocketSecurity ignore npm/@prisma/engines@5.9.1
Superseded by #979.