[Snyk] Upgrade socket.io from 4.5.1 to 4.5.4

[InimicalPart]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade socket.io from 4.5.1 to 4.5.4.

As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.

✨ Snyk has automatically assigned this pull request, set who gets assigned.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 3 versions ahead of your current version.
• The recommended version was released 25 days ago, on 2022-11-22.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-QS-3153490	554/1000 Why? Proof of Concept exploit, Recently disclosed, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: socket.io

• 4.5.4 - 2022-11-22
  

  This release contains a bump of:

  • engine.io in order to fix CVE-2022-41940
  • socket.io-parser in order to fix CVE-2022-2421.

  Links:

  • Diff: 4.5.3...4.5.4
  • Client release: 4.5.4
  • engine.io@~6.2.1 (diff)
  • ws@~8.2.3
• 4.5.3 - 2022-10-15
  

  Bug Fixes

  • typings: accept an HTTP2 server in the constructor (d3d0a2d)
  • typings: apply types to "io.timeout(...).emit()" calls (e357daf)

  Links:

  • Diff: 4.5.2...4.5.3
  • Client release: 4.5.3
  • engine.io version: ~6.2.0
  • ws version: ~8.2.3
• 4.5.2 - 2022-09-02
  

  Bug Fixes

  • prevent the socket from joining a room after disconnection (18f3fda)
  • uws: prevent the server from crashing after upgrade (ba497ee)

  Links:

  • Diff: 4.5.1...4.5.2
  • Client release: 4.5.2
  • engine.io version: ~6.2.0
  • ws version: ~8.2.3
• 4.5.1 - 2022-05-17
  

  Bug Fixes

  • forward the local flag to the adapter when using fetchSockets() (30430f0)
  • typings: add HTTPS server to accepted types (#4351) (9b43c91)

  Links:

  • Diff: 4.5.0...4.5.1
  • Client release: 4.5.1
  • engine.io version: ~6.2.0
  • ws version: ~8.2.3

from socket.io GitHub release notes

Commit messages

Package name: socket.io

• 3b7ced7 chore(release): 4.5.4
• c00bb95 chore: bump engine.io to version 6.2.1
• 57e5f25 chore: bump socket.io-parser to version 4.2.1
• f4b6984 docs: add missing versions in the changelog
• 945c84b chore(release): 4.5.3
• d3d0a2d fix(typings): accept an HTTP2 server in the constructor
• 19b225b docs(examples): update dependencies of the basic CRUD example
• 8fae95d docs: add jsdoc for each public method
• e6f6b90 docs: add deprecation notice for the allSockets() method
• 596eb88 ci: upgrade to actions/checkout@3 and actions/setup-node@3
• e357daf fix(typings): apply types to "io.timeout(...).emit()" calls
• 10fa4a2 refactor: add list of possible disconnection reasons
• 8be95b3 chore(release): 4.5.2
• ba497ee fix(uws): prevent the server from crashing after upgrade
• 2803871 ci: add explicit permissions to workflow (#4466)
• 134226e refactor: add missing constraints (#4431)
• 9890b03 chore: bump dependencies
• 713a6b4 chore: bump mocha to version 10.0.0
• 18f3fda fix: prevent the socket from joining a room after disconnection

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

👩‍💻 Set who automatically gets assigned

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs