fix(deps): update dependency socket.io to v4.6.2 [security] - abandoned

package.json

@@ -271,10 +271,12 @@
   "resolutions": {
     "**/@types/cheerio": "0.22.21",
     "**/@types/enzyme": "3.10.5",
+    "**/engine.io": "6.4.2",
     "**/jquery": "3.7.1",
     "**/pretty-format": "26.4.0",
     "**/sharp": "0.29.3",
-    "**/socket.io-parser": "4.0.5",
+    "**/socket.io": "4.6.2",
+    "**/socket.io-parser": "4.2.4",
     "**/ua-parser-js": "0.7.33",
     "@types/react": "18.3.12",
     "browserify-sign": "4.2.2",

packages/server/lib/socket-base.ts

@@ -122,7 +122,7 @@ export class SocketBase {
     return new CDPSocketServer({ path: socketIoRoute })
   }
 
-  createSocketIo (server: DestroyableHttpServer, path: string, cookie: string | boolean) {
+  createSocketIo (server: DestroyableHttpServer, path: string, cookie: string) {
     return new socketIo.SocketIOServer(server, {
       path,
       cookie: {

packages/server/package.json

@@ -200,7 +200,7 @@
     "request-promise": "4.2.6",
     "sinon": "17.0.1",
     "snap-shot-it": "7.9.10",
-    "socket.io": "4.0.1",
+    "socket.io": "4.6.2",
     "ssestream": "1.0.1",
     "supertest": "4.0.2",
     "supertest-session": "4.0.0",

packages/socket/lib/browser.ts

@@ -26,10 +26,10 @@ export function client (uri: string, opts?: Partial<ManagerOptions & SocketOptio
     // Connect the socket regardless of whether or not we have newly created it
     window.cypressSockets[fullNamespace].connect()
 
-    // @ts-expect-error TODO: fix type
     return window.cypressSockets[fullNamespace]
   }
 
+  // @ts-expect-error - socket.io client is compatible with SocketShape
   return io(uri, opts)
 }
 
@@ -49,10 +49,10 @@ export function createWebsocket ({ path, browserFamily }: { path: string, browse
     // Connect the socket regardless of whether or not we have newly created it
     window.cypressSockets[fullNamespace].connect()
 
-    // @ts-expect-error TODO: fix type
     return window.cypressSockets[fullNamespace]
   }
 
+  // @ts-expect-error - socket.io client is compatible with SocketShape
   return io({
     path,
     // TODO(webkit): the websocket socket.io transport is busted in WebKit, need polling

packages/socket/lib/cdp-browser.ts

@@ -52,8 +52,7 @@ export class CDPBrowserSocket extends Emitter implements SocketShape {
     }, 0)
   }
 
-  // @ts-expect-error TODO: fix emit type
-  emit = async (event: string, ...args: any[]) => {
+  emit = (event: string, ...args: any[]) => {
     // Generate a unique key for this event
     const uuid = uuidv4()
     let callback
@@ -66,8 +65,10 @@ export class CDPBrowserSocket extends Emitter implements SocketShape {
       this.once(uuid, callback)
     }
 
-    await encode([event, uuid, args], this._namespace).then((encoded: any) => {
+    encode([event, uuid, args], this._namespace).then((encoded: any) => {
       window[`cypressSendToServer-${this._namespace}`](JSON.stringify(encoded))
+    }).catch(() => {
+      // Silently handle encoding errors
     })
 
     return this

packages/socket/lib/types.ts

@@ -1,3 +1,3 @@
 import type Emitter from 'component-emitter'
 
-export type SocketShape = Emitter
+export type SocketShape = InstanceType<typeof Emitter>

packages/socket/package.json

@@ -17,14 +17,14 @@
     "tslint": "tslint --config ../ts/tslint.json --project ."
   },
   "dependencies": {
-    "component-emitter": "1.3.0",
+    "component-emitter": "2.0.0",
     "debug": "^4.4.0",
     "engine.io": "6.4.2",
-    "engine.io-parser": "4.0.2",
+    "engine.io-parser": "5.0.4",
     "flatted": "3.2.9",
-    "socket.io": "4.0.1",
-    "socket.io-client": "4.0.1",
-    "socket.io-parser": "4.0.5",
+    "socket.io": "4.6.2",
+    "socket.io-client": "4.6.2",
+    "socket.io-parser": "4.2.4",
     "uuid": "8.3.2"
   },
   "devDependencies": {

packages/socket/patches/engine.io-parser+5.0.4.patch

@@ -0,0 +1,32 @@
+diff --git a/node_modules/engine.io-parser/build/cjs/encodePacket.browser.js b/node_modules/engine.io-parser/build/cjs/encodePacket.browser.js
+index b06ec9b..e69d616 100644
+--- a/node_modules/engine.io-parser/build/cjs/encodePacket.browser.js
++++ b/node_modules/engine.io-parser/build/cjs/encodePacket.browser.js
+@@ -5,6 +5,15 @@ const withNativeBlob = typeof Blob === "function" ||
+     (typeof Blob !== "undefined" &&
+         Object.prototype.toString.call(Blob) === "[object BlobConstructor]");
+ const withNativeArrayBuffer = typeof ArrayBuffer === "function";
++/**
++ * Returns true if obj is an ArrayBuffer.
++ * This extra check is made because the "instanceof ArrayBuffer" check does not work
++ * across different execution contexts.
++ * @private
++ */
++ function isArrayBuffer(obj) {
++    return typeof obj === 'object' && obj !== null && toString.call(obj) === '[object ArrayBuffer]';
++}
+ // ArrayBuffer.isView method is not defined in IE10
+ const isView = obj => {
+     return typeof ArrayBuffer.isView === "function"
+@@ -21,9 +30,9 @@ const encodePacket = ({ type, data }, supportsBinary, callback) => {
+         }
+     }
+     else if (withNativeArrayBuffer &&
+-        (data instanceof ArrayBuffer || isView(data))) {
++        (data instanceof ArrayBuffer || isArrayBuffer(data) || isView(data))) {
+         if (supportsBinary) {
+-            return callback(data);
++            return callback((data instanceof ArrayBuffer || isArrayBuffer(data)) ? data : data.buffer);
+         }
+         else {
+             return encodeBlobAsBase64(new Blob([data]), callback);

packages/socket/patches/socket.io-parser+4.0.5.patch → packages/socket/patches/socket.io-parser+4.2.4.patch

@@ -1,11 +1,11 @@
-diff --git a/node_modules/socket.io-parser/dist/binary.js b/node_modules/socket.io-parser/dist/binary.js
-index 50ed998..0492ec4 100644
---- a/node_modules/socket.io-parser/dist/binary.js
-+++ b/node_modules/socket.io-parser/dist/binary.js
+diff --git a/node_modules/socket.io-parser/build/cjs/binary.js b/node_modules/socket.io-parser/build/cjs/binary.js
+index 4dfe08f..6fd7d98 100644
+--- a/node_modules/socket.io-parser/build/cjs/binary.js
++++ b/node_modules/socket.io-parser/build/cjs/binary.js
 @@ -2,6 +2,9 @@
  Object.defineProperty(exports, "__esModule", { value: true });
  exports.reconstructPacket = exports.deconstructPacket = void 0;
- const is_binary_1 = require("./is-binary");
+ const is_binary_js_1 = require("./is-binary.js");
 +/**
 + * This file is patched to enable circular objects to be sent over socket.io.
 + */
@@ -26,7 +26,7 @@ index 50ed998..0492ec4 100644
 +function _deconstructPacket(data, buffers, known, retvals) {
      if (!data)
          return data;
-     if (is_binary_1.isBinary(data)) {
+     if ((0, is_binary_js_1.isBinary)(data)) {
 @@ -26,18 +29,27 @@ function _deconstructPacket(data, buffers) {
          buffers.push(data);
          return placeholder;
@@ -41,7 +41,7 @@ index 50ed998..0492ec4 100644
 +    known.push(data)
 +    if (Array.isArray(data)) {
          const newData = new Array(data.length);
-+        retvals.set(data, newData)
++        retvals.set(data, newData);
          for (let i = 0; i < data.length; i++) {
 -            newData[i] = _deconstructPacket(data[i], buffers);
 +            newData[i] = _deconstructPacket(data[i], buffers, known, retvals);
@@ -50,11 +50,10 @@ index 50ed998..0492ec4 100644
      }
      else if (typeof data === "object" && !(data instanceof Date)) {
          const newData = {};
-+        retvals.set(data, newData)
++        retvals.set(data, newData);
          for (const key in data) {
--            if (data.hasOwnProperty(key)) {
+             if (Object.prototype.hasOwnProperty.call(data, key)) {
 -                newData[key] = _deconstructPacket(data[key], buffers);
-+            if (Object.prototype.hasOwnProperty.call(data, key)) {
 +                newData[key] = _deconstructPacket(data[key], buffers, known, retvals);
              }
          }
@@ -65,7 +64,7 @@ index 50ed998..0492ec4 100644
  function reconstructPacket(packet, buffers) {
 -    packet.data = _reconstructPacket(packet.data, buffers);
 +    packet.data = _reconstructPacket(packet.data, buffers, []);
-     packet.attachments = undefined; // no longer useful
+     delete packet.attachments; // no longer useful
      return packet;
  }
  exports.reconstructPacket = reconstructPacket;
@@ -74,14 +73,14 @@ index 50ed998..0492ec4 100644
      if (!data)
          return data;
      if (data && data._placeholder === true) {
-@@ -71,16 +83,19 @@ function _reconstructPacket(data, buffers) {
-         else {
+@@ -72,15 +84,19 @@ function _reconstructPacket(data, buffers) {
              throw new Error("illegal attachments");
          }
-+    } else if (known.includes(data)) {
-+        return data
      }
 -    else if (Array.isArray(data)) {
++    else if (known.includes(data)) {
++        return data
++    }
 +    known.push(data)
 +    if (Array.isArray(data)) {
          for (let i = 0; i < data.length; i++) {
@@ -91,46 +90,46 @@ index 50ed998..0492ec4 100644
      }
      else if (typeof data === "object") {
          for (const key in data) {
-             if (data.hasOwnProperty(key)) {
+             if (Object.prototype.hasOwnProperty.call(data, key)) {
 -                data[key] = _reconstructPacket(data[key], buffers);
 +                data[key] = _reconstructPacket(data[key], buffers, known);
              }
          }
      }
-diff --git a/node_modules/socket.io-parser/dist/index.js b/node_modules/socket.io-parser/dist/index.js
-index b0c8727..3b2dcc3 100644
---- a/node_modules/socket.io-parser/dist/index.js
-+++ b/node_modules/socket.io-parser/dist/index.js
-@@ -5,6 +5,7 @@ const Emitter = require("component-emitter");
- const binary_1 = require("./binary");
- const is_binary_1 = require("./is-binary");
- const debug = require("debug")("socket.io-parser");
+diff --git a/node_modules/socket.io-parser/build/cjs/index.js b/node_modules/socket.io-parser/build/cjs/index.js
+index df82588..64cc302 100644
+--- a/node_modules/socket.io-parser/build/cjs/index.js
++++ b/node_modules/socket.io-parser/build/cjs/index.js
+@@ -6,6 +6,7 @@ const binary_js_1 = require("./binary.js");
+ const is_binary_js_1 = require("./is-binary.js");
+ const debug_1 = require("debug"); // debug()
+ const debug = (0, debug_1.default)("socket.io-parser"); // debug()
 +const flatted = require("flatted");
  /**
-  * Protocol version.
-  *
-@@ -66,7 +67,7 @@ class Encoder {
+  * These strings must not be used as event names, as they have a special meaning.
+  */
+@@ -89,7 +90,7 @@ class Encoder {
          }
          // json data
          if (null != obj.data) {
--            str += JSON.stringify(obj.data);
-+            str += flatted.stringify(obj.data);
+-            str += JSON.stringify(obj.data, this.replacer);
++            str += flatted.stringify(obj.data, this.replacer);
          }
          debug("encoded %j as %s", obj, str);
          return str;
-@@ -235,7 +236,7 @@ class Decoder extends Emitter {
- exports.Decoder = Decoder;
- function tryParse(str) {
-     try {
--        return JSON.parse(str);
-+        return flatted.parse(str);
+@@ -243,7 +244,7 @@ class Decoder extends component_emitter_1.Emitter {
      }
-     catch (e) {
-         return false;
-diff --git a/node_modules/socket.io-parser/dist/is-binary.js b/node_modules/socket.io-parser/dist/is-binary.js
+     tryParse(str) {
+         try {
+-            return JSON.parse(str, this.reviver);
++            return flatted.parse(str, this.reviver);
+         }
+         catch (e) {
+             return false;
+diff --git a/node_modules/socket.io-parser/build/cjs/is-binary.js b/node_modules/socket.io-parser/build/cjs/is-binary.js
 index 4b7c234..73ec260 100644
---- a/node_modules/socket.io-parser/dist/is-binary.js
-+++ b/node_modules/socket.io-parser/dist/is-binary.js
+--- a/node_modules/socket.io-parser/build/cjs/is-binary.js
++++ b/node_modules/socket.io-parser/build/cjs/is-binary.js
 @@ -1,6 +1,7 @@
  "use strict";
  Object.defineProperty(exports, "__esModule", { value: true });

packages/types/package.json

@@ -19,7 +19,7 @@
     "better-sqlite3": "11.5.0",
     "devtools-protocol": "0.0.1459876",
     "express": "4.21.0",
-    "socket.io": "4.0.1",
+    "socket.io": "4.6.2",
     "typescript": "~5.4.5"
   },
   "files": [