Packages

socket.io

4.8.4 · 25 Sep 2026MIT16.6M / weekRepositoryHomepagenpmAtom feed

Upgrading socket.io from 0.3.8 to 4.8.4

150 releases in betweennotes for 50

Other targets from 0.3.8Newest 0.x0.9.19Clears its 3 advisories2.5.1
3.0.0, 1.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below; the migration guide covers them.
3+
changes to make
3
advisories fixed
45+
new
98+
fixes

Counted from 50 of 150 release notes. Advisories are counted from the advisory database, in full.

Start here

Before you upgrade

Tick each one off as you go
  • breaking2.4.1
  • breaking2.0.0
  • deprecated4.8.2

Security

Fixes 3 advisories affecting 0.3.8

Release by release

  1. 4.8.4

    25 Sep 20265 fixes
    • fixed

      Cleanup pending acks on timeout to prevent memory leak

    • fixed

      Prevent uWebSockets.js from serving missing client files

    • fixed

      Reject stateful regexps for dynamic namespaces

    • fixed

      types: allow emitWithAck() for events with void callbacks

    • fixed

      types: properly import http module

  2. 4.8.3

    23 Dec 20251 fix
    • fixed

      Do not throw when calling io.close() on a stopped server

  3. 4.8.2

    22 Dec 20252 fixes
    • fixed

      Call adapter.init() when creating each namespace

    • fixed

      Improve io.close() function

  4. 4.8.1nothing new or fixed in the note

  5. 4.8.0

    21 Sep 20243 fixes
    • fixed

      Allow to join a room in a middleware (uws)

    • fixed

      Correctly await async close on adapters

    • fixed

      Expose type of default engine

  6. 4.7.5

    14 Mar 20242 fixes
    • fixed

      Close the adapters when the server is closed

    • fixed

      Remove duplicate pipeline when serving bundle

  7. 4.7.4

    12 Jan 20241 fix
    • fixed

      typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914

  8. 4.7.3

    3 Jan 20242 fixes
    • fixed

      Return the first response when broadcasting to a single socket

    • fixed

      typings: allow to bind to a non-secure Http2Server

25 other lines we could not sort, mostly version bumps

  • Without CORS (server and client are served from the same domain):

    2.4.1

  • With CORS (server and client are served from distinct domains):

    2.4.1

  • Diff: 2.4.0...2.4.1

    2.4.1

  • Client release:

    2.4.1

  • ws was reverted as the default wsEngine (#550), as there was several blocking issues with uws. You can still use uws by running npm install uws --save in your project and using the wsEngine option:

    2.1.0

  • pingTimeout now defaults to 5 seconds (instead of 60 seconds): #551

    2.1.0

  • Diff: 2.0.4...2.1.0

    2.1.0

  • Client release: 2.1.0

    2.1.0

  • Engine.io version: ~3.2.0 (diff: 3.1.0...3.2.0)

    2.1.0

  • Ws version: ~3.3.1 (diff: 2.3.1...3.3.1)

    2.1.0

96 internal lines (docs, tests, tooling) left out.