Skip to content

Bump ws, engine.io-client and socket.io#218

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-1e58be17cf
Open

Bump ws, engine.io-client and socket.io#218
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-1e58be17cf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 22, 2026

Copy link
Copy Markdown
Contributor

Bumps ws, engine.io-client and socket.io. These dependencies needed to be updated together.
Updates ws from 7.5.9 to 7.5.11

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

  • Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

  • Backported e55e5106 to the 7.x release line (22c28763).
Commits

Updates engine.io-client from 6.6.3 to 6.6.5

Release notes

Sourced from engine.io-client's releases.

engine.io-client@6.6.5

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Dependencies

engine.io-client@6.6.4

This release contains a bump of:

  • ws from ~8.17.1 to ~8.18.3
  • debug from ~4.3.1 to ~4.4.1

Bug Fixes

Dependencies

Commits
  • 8413bce chore(release): engine.io-client@6.6.5
  • c10fe07 refactor(eio-client): improve JSDoc documentation
  • 9349b14 refactor(eio-client): remove unused import
  • ffe51e2 chore(release): engine.io@6.6.8
  • f86b95f fix(eio): clean up resources upon WebTransport handshake failure
  • 4276e59 refactor(eio): fix typo in the cookie option
  • 5257ef9 chore(deps): upgrade to ws@8.20.1 (#5439)
  • 439a8f6 chore(release): engine.io@6.6.7
  • fc11285 fix(eio): close HTTP requests with invalid content type
  • b059af6 refactor(eio): use plain IncomingMessage in the public API
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io-client since your current version.


Updates socket.io from 4.7.5 to 4.8.3

Release notes

Sourced from socket.io's releases.

socket.io@4.8.3

Bug Fixes

  • do not throw when calling io.close() on a stopped server (9581f9b)

Dependencies

socket.io-client@4.8.3

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

socket.io@4.8.2

The url.parse() function is now deprecated and has been replaced by new URL() (see 8af7019).

Bug Fixes

  • call adapter.init() when creating each namespace (f3e1f5e)
  • improve io.close() function (#5344) (bb0b480)

Dependencies

socket.io-client@4.8.2

Bug Fixes

  • bundle: do not mangle the "_placeholder" attribute (bis) (cdae019)
  • drain queue before emitting "connect" (#5259) (d19928e)

Dependencies

socket.io@4.8.1

Due to a change in the bundler configuration, the production bundle (socket.io.min.js) did not support sending and receiving binary data in version 4.8.0. This is now fixed.

Dependencies

... (truncated)

Commits
  • 9978574 chore(release): socket.io@4.8.3
  • e9e5bed chore(release): socket.io-client@4.8.3
  • 9581f9b fix(sio): do not throw when calling io.close() on a stopped server
  • 579d43f refactor: remove unused files
  • ee9aac3 chore(release): socket.io-parser@4.2.5
  • 968277c chore(release): socket.io-adapter@2.5.6
  • 2bf16bd chore(release): engine.io-client@6.6.4
  • ad61607 docs(eio): fix link in the release notes
  • dd71792 chore(release): socket.io@4.8.2
  • bb0b480 fix(sio): improve io.close() function (#5344)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [ws](https://github.com/websockets/ws), [engine.io-client](https://github.com/socketio/socket.io) and [socket.io](https://github.com/socketio/socket.io). These dependencies needed to be updated together.

Updates `ws` from 7.5.9 to 7.5.11
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.9...7.5.11)

Updates `engine.io-client` from 6.6.3 to 6.6.5
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/engine.io-client@6.6.3...engine.io-client@6.6.5)

Updates `socket.io` from 4.7.5 to 4.8.3
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io@4.7.5...socket.io@4.8.3)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 7.5.11
  dependency-type: indirect
- dependency-name: engine.io-client
  dependency-version: 6.6.5
  dependency-type: indirect
- dependency-name: socket.io
  dependency-version: 4.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants