fix(deps): update dependency socket.io-parser to v4.2.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
socket.io-parser (source)	4.0.5 → 4.2.3

GitHub Vulnerability Alerts

CVE-2023-32695

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Patches

A fix has been released today (2023/05/22):

• socketio/socket.io-parser@3b78117, included in socket.io-parser@4.2.3
• socketio/socket.io-parser@2dc3c92, included in socket.io-parser@3.4.3

Another fix has been released for the 3.3.x branch:

• socketio/socket.io-parser@ee00660, included in `socket.io-parser@3.3.4

socket.io version	socket.io-parser version	Needs minor update?
4.5.2...latest	~4.2.0 (ref)	npm audit fix should be sufficient
4.1.3...4.5.1	~4.1.1 (ref)	Please upgrade to socket.io@4.6.x
3.0.5...4.1.2	~4.0.3 (ref)	Please upgrade to socket.io@4.6.x
3.0.0...3.0.4	~4.0.1 (ref)	Please upgrade to socket.io@4.6.x
2.3.0...2.5.0	~3.4.0 (ref)	npm audit fix should be sufficient

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Thanks to @​rafax00 for the responsible disclosure.

---

Release Notes

socketio/socket.io (socket.io-parser)

v4.2.3

Compare Source

v4.2.2

Compare Source

v4.2.1

Compare Source

v4.2.0

Compare Source

Bug Fixes

• typings: allow async listener in typed events (ccfd8ca)

Features

• ignore the query string when serving client JavaScript (#​4024) (24fee27)

Links:

• Diff: socketio/socket.io@4.1.3...4.2.0
• Client release: 4.2.0
• engine.io version: ~5.2.0
• ws version: ~7.4.2

v4.1.2

Compare Source

Bug Fixes

• typings: ensure compatibility with TypeScript 3.x (0cb6ac9)
• ensure compatibility with previous versions of the adapter (a2cf248)

Links:

• Diff: socketio/socket.io@4.1.1...4.1.2
• Client release: 4.1.2
• engine.io version: ~5.1.0
• ws version: ~7.4.2

v4.1.1

Compare Source

Bug Fixes

• typings: properly type server-side events (b84ed1e)
• typings: properly type the adapter attribute (891b187)

Links:

• Diff: socketio/socket.io@4.1.0...4.1.1
• Client release: 4.1.1
• engine.io version: ~5.1.0
• ws version: ~7.4.2

v4.1.0

Compare Source

Blog post: https://socket.io/blog/socket-io-4-1-0/

Features

• add support for inter-server communication (93cce05)
• notify upon namespace creation (499c892)
• add a "connection_error" event (7096e98, from engine.io)
• add the "initial_headers" and "headers" events (2527543, from engine.io)

Links:

• Diff: socketio/socket.io@4.0.2...4.1.0
• Client release: 4.1.0
• engine.io version: ~5.1.0
• ws version: ~7.4.2

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cypress-app-bot]

See the guidelines for reviewing dependency updates for info on how to review dependency update PRs.