Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): bump engine.io and browser-sync in /web #574

Closed
wants to merge 1 commit into from
Closed

chore(deps): bump engine.io and browser-sync in /web #574

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 2, 2022 •
edited by moul-bot

Bumps engine.io to 6.2.0 and updates ancestor dependency browser-sync. These dependencies need to be updated together.

Updates engine.io from 3.5.0 to 6.2.0

Release notes

Sourced from [engine.io's releases](https://github.com/socketio/engine.io/releases).

6.2.0

Features

  • add the "maxPayload" field in the handshake details ([088dcb4](https://github.com/socketio/engine.io/commit/088dcb4dff60df39785df13d0a33d3ceaa1dff38))

So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize value.

This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as we only add a field in the JSON-encoded handshake data:

0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links

  • Diff: [https://github.com/socketio/engine.io/compare/6.1.3...6.2.0](https://github.com/socketio/engine.io/compare/6.1.3...6.2.0)
  • Client release: [6.2.0](https://github.com/socketio/engine.io-client/releases/tag/6.2.0)
  • ws version: [~8.2.3](https://github.com/websockets/ws/releases/tag/8.2.3)

6.1.3

Bug Fixes

Links

  • Diff: [https://github.com/socketio/engine.io/compare/6.1.2...6.1.3](https://github.com/socketio/engine.io/compare/6.1.2...6.1.3)
  • Client release: -
  • ws version: [~8.2.3](https://github.com/websockets/ws/releases/tag/8.2.3)

6.1.2

Bug Fixes

  • uws: expose additional uWebSockets.js options ([chore(deps): bump actions/cache from 3.0.6 to 3.2.5 #634](https://github-redirect.dependabot.com/uServer: accept compression option socketio/engine.io#634)) ([49bb7cf](https://github.com/socketio/engine.io/commit/49bb7cf66518d4b49baf883a16ee1fe1ed8aed28))
  • uws: fix HTTP long-polling with CORS ([45112a3](https://github.com/socketio/engine.io/commit/45112a30d1af4cc25b21a5d658a748583cb64ed4))
  • uws: handle invalid websocket upgrades ([8b4d6a8](https://github.com/socketio/engine.io/commit/8b4d6a8176db72f5c2420c5a45f0d97d33af049b))

Links

  • Diff: [https://github.com/socketio/engine.io/compare/6.1.1...6.1.2](https://github.com/socketio/engine.io/compare/6.1.1...6.1.2)
  • Client release: -
  • ws version: [~8.2.3](https://github.com/websockets/ws/releases/tag/8.2.3)

6.1.1

⚠️ This release contains an important security fix ⚠️

... (truncated)

Changelog

Sourced from [engine.io's changelog](https://github.com/socketio/engine.io/blob/main/CHANGELOG.md).

[6.2.0](https://github.com/socketio/engine.io/compare/6.1.3...6.2.0) (2022-04-17)

Features

  • add the "maxPayload" field in the handshake details ([088dcb4](https://github.com/socketio/engine.io/commit/088dcb4dff60df39785df13d0a33d3ceaa1dff38))

So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize value.

This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as we only add a field in the JSON-encoded handshake data:

0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

[6.1.3](https://github.com/socketio/engine.io/compare/6.1.2...6.1.3) (2022-02-23)

Bug Fixes

[6.1.2](https://github.com/socketio/engine.io/compare/6.1.1...6.1.2) (2022-01-18)

Bug Fixes

  • uws: expose additional uWebSockets.js options ([chore(deps): bump actions/cache from 3.0.6 to 3.2.5 #634](https://github-redirect.dependabot.com/uServer: accept compression option socketio/engine.io#634)) ([49bb7cf](https://github.com/socketio/engine.io/commit/49bb7cf66518d4b49baf883a16ee1fe1ed8aed28))
  • uws: fix HTTP long-polling with CORS ([45112a3](https://github.com/socketio/engine.io/commit/45112a30d1af4cc25b21a5d658a748583cb64ed4))
  • uws: handle invalid websocket upgrades ([8b4d6a8](https://github.com/socketio/engine.io/commit/8b4d6a8176db72f5c2420c5a45f0d97d33af049b))

[6.1.1](https://github.com/socketio/engine.io/compare/6.1.0...6.1.1) (2022-01-11)

⚠️ This release contains an important security fix ⚠️

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14) at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22) at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10)

... (truncated)

Commits

Updates browser-sync from 2.26.14 to 2.27.10

Release notes

Sourced from [browser-sync's releases](https://github.com/BrowserSync/browser-sync/releases).

2.27.9

What's Changed

A bug prevented the help output from displaying - it was introduced when the CLI parser yargs was updated, and is now fixed :)

Full Changelog: [https://github.com/BrowserSync/browser-sync/compare/v2.27.8...v2.27.9](https://github.com/BrowserSync/browser-sync/compare/v2.27.8...v2.27.9)

2.27.8

This release upgrades Socket.io (client+server) to the latest versions - solving the following issues, and silencing security warning :)

PR:

  • [https://github.com/BrowserSync/browser-sync/commit/58ab4ab861d7c50b4349f25bdd4c7f8871d0ad32](https://github.com/BrowserSync/browser-sync/commit/58ab4ab861d7c50b4349f25bdd4c7f8871d0ad32)

Resolved Issues:

Thanks to @​lachieh for the original PR, which helped me land this fix

added snippet: boolean option

This release adds a feature to address [BrowserSync/browser-sync#1882](https://github-redirect.dependabot.com/BrowserSync/browser-sync/issues/1882)

Sometimes you don't want Browsersync to auto-inject it's connection snippet into your HTML - now you can disable it globally via either a CLI param or the new snippet option :)

browser-sync . --no-snippet

or in any Browsersync configuration

const config = {
  snippet: false,
};

the original request was related to Eleventy usage, so here's how that would look

eleventyConfig.setBrowserSyncConfig({
  snippet: false,
});
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

┆Issue is synchronized with this Trello card

@dependabot
chore(deps): bump engine.io and browser-sync in /web
d5d862c 
Bumps [engine.io](https://github.com/socketio/engine.io) to 6.2.0 and updates ancestor dependency [browser-sync](https://github.com/BrowserSync/browser-sync). These dependencies need to be updated together.


Updates `engine.io` from 3.5.0 to 6.2.0
- [Release notes](https://github.com/socketio/engine.io/releases)
- [Changelog](https://github.com/socketio/engine.io/blob/main/CHANGELOG.md)
- [Commits](socketio/engine.io@3.5.0...6.2.0)

Updates `browser-sync` from 2.26.14 to 2.27.10
- [Release notes](https://github.com/BrowserSync/browser-sync/releases)
- [Changelog](https://github.com/BrowserSync/browser-sync/blob/master/CHANGELOG.md)
- [Commits](BrowserSync/browser-sync@v2.26.14...v2.27.10)

---
updated-dependencies:
- dependency-name: engine.io
  dependency-type: indirect
- dependency-name: browser-sync
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from moul as a code owner October 2, 2022 07:40
@dependabot dependabot bot added dependencies javascript Pull requests that update Javascript code labels Oct 2, 2022
@trafico-bot trafico-bot bot added the 🔍 Ready for Review Pull Request is not reviewed yet label Oct 2, 2022
@socket-security
Copy link

Socket Security Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 New install scripts detected

A dependency change in this PR is introducing new install scripts to your install step.

Package Script field Location
core-js-pure@3.25.3 (upgraded) postinstall web/package.json via eslint-plugin-jsx-a11y@6.5.1, aria-query@4.2.2, @babel/runtime-corejs3@7.18.9
Socket.dev scan summary
Issue Status
Did you mean? ✅ no new possible package typos
Install scripts ⚠️ 1 new install script detected
Telemetry ✅ no new telemetry
Troll package ✅ no new troll packages
Malware ✅ no new malware
Native code ✅ no new native modules
Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2

  • @SocketSecurity ignore core-js-pure@3.25.3

⚠️ Please accept the latest app permissions to ensure bot commands work properly. Accept the new permissions here.

Powered by socket.dev

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 23, 2022

Superseded by #603.

@dependabot dependabot bot closed this Nov 23, 2022
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/web/engine.io-and-browser-sync-6.2.0 branch November 23, 2022 23:47
@moul-bot moul-bot mentioned this pull request Mar 24, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@moul moul Awaiting requested review from moul moul is a code owner

Assignees
No one assigned
Labels
dependencies javascript Pull requests that update Javascript code 🔍 Ready for Review Pull Request is not reviewed yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
0 participants