Packages

socket.io

4.8.4 · 25 Sep 2026MIT16.6M / weekRepositoryHomepagenpmAtom feed

Upgrading socket.io from 0.6.3 to 2.5.1

102 releases in betweennotes for 18

Other targets from 0.6.3Newest 0.x0.9.19Latest4.8.4
1.0.0 has no release note on GitHub or in the repository's changelog, so its breaking changes are missing from the counts below; the migration guide covers them.
2+
changes to make
3
advisories fixed
15+
new
56+
fixes

Counted from 18 of 102 release notes. Advisories are counted from the advisory database, in full.

Start here

Before you upgrade

Tick each one off as you go
  • breaking2.4.1
  • breaking2.0.0

Security

Fixes 3 advisories affecting 0.6.3

Release by release

  1. 2.5.1

    19 Jun 20241 new · 4 fixes
    • new

      Add a noop handler for the error event

    • fixed

      Diff: 2.5.0...2.5.1

    • fixed

      Client release: -

    • fixed

      Engine.io version: ~3.6.0 (no change)

    • fixed

      Ws version: ~7.5.10

  2. 2.5.0

    26 Jun 20228 fixes
    • fixed

      Fix race condition in dynamic namespaces

    • fixed

      Ignore packet received after disconnection

    • fixed

      Only set 'connected' to true after middleware execution

    • fixed

      Prevent the socket from joining a room after disconnection

  3. 2.4.1

    7 Jan 20211 fix
    • fixed

      security: Do not allow all origins by default

  4. 2.4.0

    4 Jan 20212 new · 7 fixes
    • new

      Add support for all cookie options

    • new

      Disable perMessageDeflate by default

    • fixed

      Properly overwrite the query sent in the handshake

    • fixed

      You are using Socket.IO v2 and the origins option to restrict the list of allowed domains

  5. 2.3.0nothing new or fixed in the note

  6. 2.2.0

    28 Nov 20181 new · 6 fixes
    • new

      Add cache-control header when serving the client source

    • fixed

      Throw an error when trying to access the clients of a dynamic namespace

    • fixed

      Milestone: 2.2.0

    • fixed

      Diff: 2.1.1...2.2.0

    • fixed

      Client release: 2.2.0

    • fixed

      Engine.io version: ~3.3.1 (diff: 3.2.0...3.3.1)

    • fixed

      Ws version: ~6.1.0 (diff: 3.3.1...6.1.2)

  7. 2.1.1

    17 May 20181 new · 5 fixes
    • new

      Add local flag to the socket object (#3219)

    • fixed

      Milestone: 2.1.1

    • fixed

      Diff: 2.1.0...2.1.1

    • fixed

      Client release: 2.1.1

    • fixed

      Engine.io version: ~3.2.0

    • fixed

      Ws version: ~3.3.1

  8. 2.1.0

    29 Mar 20182 new · 2 fixes
    • new

      Add a 'binary' flag

    • new

      Add support for dynamic namespaces

    • fixed

      Properly emit 'connect' when using a custom namespace

    • fixed

      Include the protocol in the origins check

25 other lines we could not sort, mostly version bumps

  • Without CORS (server and client are served from the same domain):

    2.4.1

  • With CORS (server and client are served from distinct domains):

    2.4.1

  • Diff: 2.4.0...2.4.1

    2.4.1

  • Client release:

    2.4.1

  • ws was reverted as the default wsEngine (#550), as there was several blocking issues with uws. You can still use uws by running npm install uws --save in your project and using the wsEngine option:

    2.1.0

  • pingTimeout now defaults to 5 seconds (instead of 60 seconds): #551

    2.1.0

  • Diff: 2.0.4...2.1.0

    2.1.0

  • Client release: 2.1.0

    2.1.0

  • Engine.io version: ~3.2.0 (diff: 3.1.0...3.2.0)

    2.1.0

  • Ws version: ~3.3.1 (diff: 2.3.1...3.3.1)

    2.1.0

55 internal lines (docs, tests, tooling) left out.