build(deps): bump engine.io and socket.io

[dependabot[bot]]

Bumps engine.io and socket.io. These dependencies needed to be updated together. Updates engine.io from 6.1.3 to 6.4.0

Release notes

Sourced from engine.io's releases.

6.4.0

Features

• add support for Express middlewares (24786e7)

This commit implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.

A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.

Syntax:

engine.use((req, res, next) => {
  // do something
next();
});
// with express-session
import session from "express-session";
engine.use(session({
secret: "keyboard cat",
resave: false,
saveUninitialized: true,
cookie: { secure: true }
}));
// with helmet
import helmet from "helmet";
engine.use(helmet());

Links

• Diff: https://github.com/socketio/engine.io/compare/6.3.1...6.4.0
• Client release: 6.4.0
• ws version: ~8.11.0 (no change)

6.3.1

Links

• Diff: https://github.com/socketio/engine.io/compare/6.3.0...6.3.1
• Client release: -
• ws version: ~8.11.0 (no change)

6.3.0

Bug Fixes

... (truncated)

Changelog

Sourced from engine.io's changelog.

6.4.0 (2023-02-06)

Features

• add support for Express middlewares (24786e7)

This commit implements middlewares at the Engine.IO level, because Socket.IO middlewares are meant for namespace authorization and are not executed during a classic HTTP request/response cycle.

A workaround was possible by using the allowRequest option and the "headers" event, but this feels way cleaner and works with upgrade requests too.

Syntax:

engine.use((req, res, next) => {
  // do something
next();
});
// with express-session
import session from "express-session";
engine.use(session({
secret: "keyboard cat",
resave: false,
saveUninitialized: true,
cookie: { secure: true }
}));
// with helmet
import helmet from "helmet";
engine.use(helmet());

Dependencies

• ws@~8.11.0 (no change)

6.3.1 (2023-01-12)

Dependencies

• ws@~8.11.0 (no change)

... (truncated)

Commits

• 898bd1c chore(release): 6.4.0
• 6220d14 chore(deps): bump cookiejar from 2.1.2 to 2.1.4 (#667)
• 24786e7 feat: add support for Express middlewares
• 4d6f454 chore(release): 6.3.1
• 69603b9 refactor: make the compress option optional
• ae1ea77 chore(release): 6.3.0
• a65a047 fix: wait for all packets to be sent before closing the WebSocket connection
• ed87609 fix: fix the ES module wrapper
• bc98bf1 refactor: bump prettier to version 2.8.1
• 33dc073 docs: add some TODOs for the next major release
• Additional commits viewable in compare view

Updates socket.io from 4.4.1 to 4.6.0

Release notes

Sourced from socket.io's releases.

4.6.0

Bug Fixes

• add timeout method to remote socket (#4558) (0c0eb00)
• typings: properly type emits with timeout (f3ada7d)

Features

Promise-based acknowledgements

This commit adds some syntactic sugar around acknowledgements:

• emitWithAck()

try {
  const responses = await io.timeout(1000).emitWithAck("some-event");
  console.log(responses); // one response per client
} catch (e) {
  // some clients did not acknowledge the event in the given delay
}
io.on("connection", async (socket) => {
// without timeout
const response = await socket.emitWithAck("hello", "world");
// with a specific timeout
try {
const response = await socket.timeout(1000).emitWithAck("hello", "world");
} catch (err) {
// the client did not acknowledge the event in the given delay
}
});

• serverSideEmitWithAck()

try {
  const responses = await io.timeout(1000).serverSideEmitWithAck("some-event");
  console.log(responses); // one response per server (except itself)
} catch (e) {
  // some servers did not acknowledge the event in the given delay
}

Added in 184f3cf.

Connection state recovery

... (truncated)

Changelog

Sourced from socket.io's changelog.

4.6.0 (2023-02-07)

Bug Fixes

• add timeout method to remote socket (#4558) (0c0eb00)
• typings: properly type emits with timeout (f3ada7d)

Features

Promise-based acknowledgements

This commit adds some syntactic sugar around acknowledgements:

• emitWithAck()

try {
  const responses = await io.timeout(1000).emitWithAck("some-event");
  console.log(responses); // one response per client
} catch (e) {
  // some clients did not acknowledge the event in the given delay
}
io.on("connection", async (socket) => {
// without timeout
const response = await socket.emitWithAck("hello", "world");
// with a specific timeout
try {
const response = await socket.timeout(1000).emitWithAck("hello", "world");
} catch (err) {
// the client did not acknowledge the event in the given delay
}
});

• serverSideEmitWithAck()

try {
  const responses = await io.timeout(1000).serverSideEmitWithAck("some-event");
  console.log(responses); // one response per server (except itself)
} catch (e) {
  // some servers did not acknowledge the event in the given delay
}

Added in 184f3cf.

... (truncated)

Commits

• a2e5d1f chore(release): 4.6.0
• d8143cc refactor: do not persist session if connection state recovery if disabled
• b2dd7cf chore: bump engine.io to version 6.4.0
• 3734b74 revert: feat: expose current offset to allow deduplication
• 8aa9499 feat: add description to the disconnecting and disconnect events (#4622)
• 4e64123 feat: expose current offset to allow deduplication
• 115a981 refactor: do not include the pid by default
• 0c0eb00 fix: add timeout method to remote socket (#4558)
• f8640d9 refactor: export DisconnectReason type
• 93d446a refactor: add charset when serving the bundle files
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sensebox/openSenseMap/network/alerts).

[dependabot[bot]]

Superseded by #468.