Skip to content

[Snyk] Security upgrade socket.io from 2.5.1 to 4.8.0 #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fengmk2 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Security upgrade socket.io from 2.5.1 to 4.8.0 #65

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
"delegates": "^1.0.0",
"is-type-of": "^1.2.1",
"koa-compose": "^4.1.0",
"socket.io": "^2.1.1",
"socket.io": "^4.8.0",

@gemini-code-assist gemini-code-assist Bot Jul 16, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This upgrade from socket.io v2 to v4 is a major change with significant breaking changes that are not addressed in this PR. Applying this change alone will break the application.

Here are the critical issues that need to be addressed:

  1. Incompatible Redis Adapter: socket.io-redis@^5.2.0 is not compatible with socket.io v4. You need to migrate to @socket.io/redis-adapter. This will require:

    • Removing socket.io-redis from dependencies.
    • Adding @socket.io/redis-adapter and a Redis client like redis.
    • Updating the adapter initialization logic in lib/io.js (lines 125-133). The new adapter setup is different. The test redis adapter works ok in test/io.test.js will fail without this change.

  2. Incompatible generateId function: socket.io v4 expects engine.generateId to be an asynchronous function. The current implementation in lib/io.js (lines 140-144) explicitly checks for and assigns a synchronous function, which will cause issues. The test should customize generateId works ok will fail.

  3. Acknowledgement Callback Signature Change: The signature for acknowledgement callbacks has changed in socket.io v3+ to be error-first: (error, ...args). The existing controller and middleware logic might not be compatible with this new signature, potentially leading to subtle bugs in event acknowledgements.

Because of these breaking changes, this PR cannot be merged as-is. It requires further changes to ensure compatibility with socket.io v4.

"socket.io-redis": "^5.2.0"
},
"devDependencies": {
Expand Down