socket.io
4.8.4 · 25 Sep 2026MIT16.6M / weekRepositoryHomepagenpmAtom feed
Upgrading socket.io from 0.9.4 to 4.8.4
104 releases in betweennotes for 33
Counted from 33 of 104 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- deprecated4.8.2
Security
Fixes 3 advisories affecting 0.9.4
- socket.io has an unhandled 'error' eventmoderate · GHSA-25hc-qcg6-38wj
- CORS misconfiguration in socket.iomoderate · GHSA-fxwf-4rqh-v8g3
- Insecure randomness in socket.iohigh · GHSA-qv2v-m59f-v5fw
- 4.5.4
engine.ioin order to fix CVE-2022-41940 - 4.5.4
socket.io-parserin order to fix CVE-2022-2421.
Release by release
- fixed
Cleanup pending acks on timeout to prevent memory leak
- fixed
Prevent uWebSockets.js from serving missing client files
- fixed
Reject stateful regexps for dynamic namespaces
- fixed
types: allow emitWithAck() for events with void callbacks
- fixed
types: properly import http module
- fixed
- fixed
Do not throw when calling io.close() on a stopped server
- fixed
- fixed
Call adapter.init() when creating each namespace
- fixed
Improve
io.close()function
- fixed
4.8.1nothing new or fixed in the note
- fixed
Allow to join a room in a middleware (uws)
- fixed
Correctly await async close on adapters
- fixed
Expose type of default engine
- fixed
- fixed
Close the adapters when the server is closed
- fixed
Remove duplicate pipeline when serving bundle
- fixed
- fixed
Return the first response when broadcasting to a single socket
- fixed
typings: allow to bind to a non-secure Http2Server
- fixed
41 internal lines (docs, tests, tooling) left out.