Bump engine.io and socket.io in /cla_socketserver

Bumps engine.io to 6.2.1 and updates ancestor dependency socket.io. These dependencies need to be updated together.

Updates engine.io from 1.8.4 to 6.2.1

Release notes

6.2.1

:warning: This release contains an important security fix :warning:

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:
Error: read ECONNRESET
    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  errno: -104,
  code: 'ECONNRESET',
  syscall: 'read'
}
Please upgrade as soon as possible.

Bug Fixes

catch errors when destroying invalid upgrades (#658) (425e833)

6.2.0

Features

add the "maxPayload" field in the handshake details (088dcb4)

So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize value.

This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as we only add a field in the JSON-encoded handshake data:
0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}
Links

Diff: https://github.com/socketio/engine.io/compare/6.1.3...6.2.0

Client release: 6.2.0

ws version: ~8.2.3

6.1.3

Bug Fixes

typings: allow CorsOptionsDelegate as cors options (#641) (a463d26)

uws: properly handle chunked content (#642) (3367440)

... (truncated)

Changelog

Sourced from engine.io's changelog.

6.2.1 (2022-11-20)

:warning: This release contains an important security fix :warning:

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:
Error: read ECONNRESET
    at TCP.onStreamRead (internal/stream_base_commons.js:209:20)
Emitted 'error' event on Socket instance at:
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  errno: -104,
  code: 'ECONNRESET',
  syscall: 'read'
}
Please upgrade as soon as possible.

Bug Fixes

catch errors when destroying invalid upgrades (#658) (425e833)

3.6.0 (2022-06-06)

Bug Fixes

add extension in the package.json main entry (#608) (3ad0567)

do not reset the ping timer after upgrade (1f5d469), closes socketio/socket.io-client-swift#1309

Features

decrease the default value of maxHttpBufferSize (58e274c)

This change reduces the default value from 100 mb to a more sane 1 mb.

This helps protect the server against denial of service attacks by malicious clients sending huge amounts of data.

See also: https://github.com/advisories/GHSA-j4f2-536g-r55m

increase the default value of pingTimeout (f55a79a)

... (truncated)

Commits

24b847b chore(release): 6.2.1
425e833 fix: catch errors when destroying invalid upgrades (#658)
99adb00 chore(deps): bump xmlhttprequest-ssl and engine.io-client in /examples/latenc...
d196f6a chore(deps): bump minimatch from 3.0.4 to 3.1.2 (#660)
7c1270f chore(deps): bump nanoid from 3.1.25 to 3.3.1 (#659)
535a01d ci: add Node.js 18 in the test matrix
1b71a6f docs: remove "Vanilla JS" highlight from README (#656)
917d1d2 refactor: replace deprecated String.prototype.substr() (#646)
020801a chore: add changelog for version 3.6.0
ed1d6f9 test: make test script work on Windows (#643)
Additional commits viewable in compare view

Updates socket.io from 1.7.4 to 4.5.4

Release notes

Sourced from socket.io's releases.

4.5.4

This release contains a bump of:

engine.io in order to fix CVE-2022-41940

socket.io-parser in order to fix CVE-2022-2421.

Links:

Diff: https://github.com/socketio/socket.io/compare/4.5.3...4.5.4

Client release: 4.5.4

engine.io@~6.2.1 (diff)

ws@~8.2.3

4.5.3

Bug Fixes

typings: accept an HTTP2 server in the constructor (d3d0a2d)

typings: apply types to "io.timeout(...).emit()" calls (e357daf)

Links:

Diff: https://github.com/socketio/socket.io/compare/4.5.2...4.5.3

Client release: 4.5.3

engine.io version: ~6.2.0

ws version: ~8.2.3

4.5.2

Bug Fixes

prevent the socket from joining a room after disconnection (18f3fda)

uws: prevent the server from crashing after upgrade (ba497ee)

Links:

Diff: https://github.com/socketio/socket.io/compare/4.5.1...4.5.2

Client release: 4.5.2

engine.io version: ~6.2.0

ws version: ~8.2.3

4.5.1

Bug Fixes

forward the local flag to the adapter when using fetchSockets() (30430f0)

typings: add HTTPS server to accepted types (#4351) (9b43c91)

Links:

Diff: https://github.com/socketio/socket.io/compare/4.5.0...4.5.1

Client release: 4.5.1

engine.io version: ~6.2.0

... (truncated)

Changelog

Sourced from socket.io's changelog.

4.5.4 (2022-11-22)

This release contains a bump of:

engine.io in order to fix CVE-2022-41940

socket.io-parser in order to fix CVE-2022-2421.

Dependencies

engine.io@~6.2.1 (diff)

ws@~8.2.3

4.5.3 (2022-10-15)

Bug Fixes

typings: accept an HTTP2 server in the constructor (d3d0a2d)

typings: apply types to "io.timeout(...).emit()" calls (e357daf)

4.5.2 (2022-09-02)

Bug Fixes

prevent the socket from joining a room after disconnection (18f3fda)

uws: prevent the server from crashing after upgrade (ba497ee)

2.5.0 (2022-06-26)

Bug Fixes

fix race condition in dynamic namespaces (05e1278)

ignore packet received after disconnection (22d4bdf)

only set 'connected' to true after middleware execution (226cc16)

prevent the socket from joining a room after disconnection (f223178)

4.5.1 (2022-05-17)

Bug Fixes

... (truncated)

Commits

3b7ced7 chore(release): 4.5.4
c00bb95 chore: bump engine.io to version 6.2.1
57e5f25 chore: bump socket.io-parser to version 4.2.1
f4b6984 docs: add missing versions in the changelog
945c84b chore(release): 4.5.3
d3d0a2d fix(typings): accept an HTTP2 server in the constructor
19b225b docs(examples): update dependencies of the basic CRUD example
8fae95d docs: add jsdoc for each public method
e6f6b90 docs: add deprecation notice for the allSockets() method
596eb88 ci: upgrade to actions/checkout@3 and actions/setup-node@3
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ministryofjustice/cla_frontend/network/alerts).