:warning: This release contains an important security fix :warning:
A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:
Error: read ECONNRESET
at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
at emitErrorNT (internal/streams/destroy.js:106:8)
at emitErrorCloseNT (internal/streams/destroy.js:74:3)
at processTicksAndRejections (internal/process/task_queues.js:80:21) {
errno: -104,
code: 'ECONNRESET',
syscall: 'read'
}
Please upgrade as soon as possible.
Bug Fixes
catch errors when destroying invalid upgrades (#658) (425e833)
6.2.0
Features
add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize
value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as
we only add a field in the JSON-encoded handshake data:
add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize
value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as
we only add a field in the JSON-encoded handshake data:
add the "maxPayload" field in the handshake details (088dcb4)
So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize
value.
This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as
we only add a field in the JSON-encoded handshake data:
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/htl-leo-syp-212223-bhif/SaferFire-2.0/network/alerts).
Bumps engine.io to 6.2.1 and updates ancestor dependencies engine.io, @nestjs/platform-socket.io and socket.io. These dependencies need to be updated together.
Updates
engine.iofrom 6.1.3 to 6.2.1Release notes
Sourced from engine.io's releases.
Changelog
Sourced from engine.io's changelog.
... (truncated)
Commits
24b847bchore(release): 6.2.1425e833fix: catch errors when destroying invalid upgrades (#658)99adb00chore(deps): bump xmlhttprequest-ssl and engine.io-client in /examples/latenc...d196f6achore(deps): bump minimatch from 3.0.4 to 3.1.2 (#660)7c1270fchore(deps): bump nanoid from 3.1.25 to 3.3.1 (#659)535a01dci: add Node.js 18 in the test matrix1b71a6fdocs: remove "Vanilla JS" highlight from README (#656)917d1d2refactor: replace deprecatedString.prototype.substr()(#646)020801achore: add changelog for version 3.6.0ed1d6f9test: make test script work on Windows (#643)Updates
@nestjs/platform-socket.iofrom 8.2.5 to 8.4.7Release notes
Sourced from
@nestjs/platform-socket.io's releases.... (truncated)
Commits
f383352chore(@nestjs) publish v8.4.7 release11c32dfMerge pull request #9731 from nestjs/dependabot/npm_and_yarn/apollo-server-co...995b516Merge pull request #9719 from delucca-workspaces/feat/export-base-rpc-context5523139Merge pull request #9686 from sushant9096/master279f6faMerge pull request #9751 from delucca-workspaces/fix/server-transport-connect...52cf0b7Merge pull request #9762 from nestjs/dependabot/npm_and_yarn/lint-staged-13.0.1bc3b431Merge pull request #9764 from nestjs/dependabot/npm_and_yarn/graphql-tools-8....ba971a7Merge pull request #9765 from nestjs/dependabot/npm_and_yarn/point-of-view-6.3.06e7cf52Merge pull request #9769 from nestjs/dependabot/npm_and_yarn/mongoose-6.3.892fc598chore(deps-dev): bump mongoose from 6.3.5 to 6.3.8Updates
socket.iofrom 4.4.1 to 4.5.1Release notes
Sourced from socket.io's releases.
... (truncated)
Changelog
Sourced from socket.io's changelog.
... (truncated)
Commits
5ab8289chore(release): 4.5.130430f0fix: forward the local flag to the adapter when using fetchSockets()9b43c91fix(typings): add HTTPS server to accepted types (#4351)8ecfcbachore(release): 4.5.0572133adocs(examples): update example with webpack6e1bb62chore: bump engine.io to version 6.2.006e6838docs(examples): add server bundling example with rollup1f03a44docs(examples): update create-react-app example (#4347)be3d7f0docs(examples): add TODO example with Postgres and Node.js clusterd12aab2docs(examples): add example with express-sessionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/htl-leo-syp-212223-bhif/SaferFire-2.0/network/alerts).