Skip to content

fix(deps): update dependency socket.io-parser to v4.2.3 [security] #32542

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
+12 −8
Open

fix(deps): update dependency socket.io-parser to v4.2.3 [security] #32542

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,7 +275,7 @@
"**/@types/cheerio": "0.22.21",
"**/@types/enzyme": "3.10.5",
"**/jquery": "3.7.1",
"**/socket.io-parser": "4.0.5",
"**/socket.io-parser": "4.2.3",
Copy link

@cursor cursor bot Oct 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Yarn Resolution Causes Socket.IO Parser Mismatch

The yarn resolution forces socket.io-parser to 4.2.3, but [email protected] is still in use. This creates a version mismatch, as [email protected] expects an older parser (~4.0.3 or ~4.0.4). The newer parser has API changes, like the component-emitter dependency structure, which [email protected] isn't compatible with, potentially causing runtime issues.

Fix in Cursor Fix in Web

"**/ua-parser-js": "0.7.33",
"@definitelytyped/typescript-versions": "0.1.9",
"@types/react": "18.3.12",
Expand Down
2 changes: 1 addition & 1 deletion packages/socket/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
"flatted": "3.2.9",
"socket.io": "4.0.1",
"socket.io-client": "4.0.1",
"socket.io-parser": "4.0.5",
"socket.io-parser": "4.2.3",
Copy link

@cursor cursor bot Sep 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Socket.io Version Mismatch Causes Runtime Issues

The socket.io package at 4.0.1 is incompatible with [email protected]. This version mismatch can lead to runtime issues, as compatibility guidelines and security advisories indicate. Using [email protected] typically requires upgrading socket.io to a compatible version, such as 4.6.x.

Fix in Cursor Fix in Web

Copy link

@cursor cursor bot Oct 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Socket.IO Parser Upgrade Causes Emitter Conflict

The socket.io-parser upgrade pulls in @socket.io/component-emitter, creating a dependency conflict with this package's direct dependency on [email protected]. This may lead to compatibility issues or unexpected behavior due to two different emitter implementations.

Fix in Cursor Fix in Web

Copy link

@cursor cursor bot Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Patch mismatch blocks circular object serialization upgrade

The socket.io-parser dependency is being upgraded from 4.0.5 to 4.2.3, but there's an existing patch file (packages/socket/patches/socket.io-parser+4.0.5.patch) that will no longer be applied. The patch-package tool requires exact version matches in the filename. This patch adds critical functionality for handling circular objects in socket.io messages using the flatted library and WeakMap tracking. Without this patch being applied to version 4.2.3, the application will lose the ability to properly serialize circular objects, potentially causing runtime errors or data corruption. A new patch file named socket.io-parser+4.2.3.patch needs to be created, or the existing patch needs to be verified as no longer necessary for version 4.2.3.

Fix in Cursor Fix in Web

"uuid": "8.3.2"
},
"devDependencies": {
Expand Down
16 changes: 10 additions & 6 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7690,6 +7690,11 @@
"@smithy/types" "^2.8.0"
tslib "^2.5.0"

"@socket.io/component-emitter@~3.1.0":
version "3.1.2"
resolved "https://registry.yarnpkg.com/@socket.io/component-emitter/-/component-emitter-3.1.2.tgz#821f8442f4175d8f0467b9daf26e3a18e2d02af2"
integrity sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA==

"@stroncium/procfs@^1.2.1":
version "1.2.1"
resolved "https://registry.yarnpkg.com/@stroncium/procfs/-/procfs-1.2.1.tgz#6b9be6fd20fb0a4c20e99a8695e083c699bb2b45"
Expand Down Expand Up @@ -29722,13 +29727,12 @@ [email protected]:
parseuri "0.0.6"
socket.io-parser "~4.0.4"

socket.io-parser@4.0.5, socket.io-parser@~4.0.3, socket.io-parser@~4.0.4:
version "4.0.5"
resolved "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-4.0.5.tgz#cb404382c32324cc962f27f3a44058cf6e0552df"
integrity sha512-sNjbT9dX63nqUFIOv95tTVm6elyIU4RvB1m8dOeZt+IgWwcWklFDOdmGcfo3zSiRsnR/3pJkjY5lfoGqEe4Eig==
socket.io-parser@4.2.3, socket.io-parser@~4.0.3, socket.io-parser@~4.0.4:
version "4.2.3"
Copy link

@cursor cursor bot Oct 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Parser Update Causes Socket.IO Compatibility Issues

Updating socket.io-parser to 4.2.3 while socket.io remains at 4.0.1 creates a version incompatibility. [email protected] expects an older parser (~4.0.3), and the parser's internal dependency shift from component-emitter to @socket.io/component-emitter may cause runtime issues.

Additional Locations (1)

Fix in Cursor Fix in Web

resolved "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-4.2.3.tgz#926bcc6658e2ae0883dc9dee69acbdc76e4e3667"
integrity sha512-JMafRntWVO2DCJimKsRTh/wnqVvO4hrfwOqtO7f+uzwsQMuxO6VwImtYxaQ+ieoyshWOTJyV0fA21lccEXRPpQ==
dependencies:
"@types/component-emitter" "^1.2.10"
component-emitter "~1.3.0"
"@socket.io/component-emitter" "~3.1.0"
debug "~4.3.1"

[email protected]:
Expand Down
Loading