Skip to content

build(deps): Bump ws, jsdom, socket.io and engine.io-client - #8544

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-f37b900b33
Open

build(deps): Bump ws, jsdom, socket.io and engine.io-client#8544
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-f37b900b33

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026

Copy link
Copy Markdown
Contributor

Bumps ws to 7.5.11 and updates ancestor dependencies ws, jsdom, socket.io and engine.io-client. These dependencies need to be updated together.

Updates ws from 7.5.10 to 7.5.11

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

  • Backported 2b2abd45 to the 7.x release line (e14c4586).
Commits

Updates jsdom from 11.11.0 to 11.12.0

Release notes

Sourced from jsdom's releases.

v11.12.0

  • Added window.localStorage, window.sessionStorage, and StorageEvent support. These are currently only stored in-memory; file an issue if you need persistent (on-disk) storage capability so we can discuss adding that. This feature includes the new storageQuota option for controlling how much can be stored.
  • Added element.closest(). (@​caub)
  • Changed hashchange and popstate events to no longer bubble, per a specification update.
  • Fixed the old API in Node.js v10 to not throw, when given input that is not a valid file path (such as a typical HTML string).
  • Upgraded cssstyle to v1.0.0, bringing along various fixes to our CSS parser and object model. (@​eddies)
  • Upgraded nwsapi to v2.0.7, bringing along various fixes to our selector engine.
Changelog

Sourced from jsdom's changelog.

11.12.0

  • Added window.localStorage, window.sessionStorage, and StorageEvent support. These are currently only stored in-memory; file an issue if you need persistent (on-disk) storage capability so we can discuss adding that. This feature includes the new storageQuota option for controlling how much can be stored.
  • Added element.closest(). (caub)
  • Changed "hashchange" and "popstate" events to no longer bubble, per a specification update.
  • Fixed the old API in Node.js v10 to not throw, when given input that is not a valid file path (such as a typical HTML string).
  • Upgraded cssstyle to v1.0.0, bringing along various fixes to our CSS parser and object model. (eddies)
  • Upgraded nwsapi to v2.0.7, bringing along various fixes to our selector engine.
Commits
  • 4d26c67 Version 11.12.0
  • d6688e5 Implement Element.prototype.closest()
  • 9191218 Upgrade NWSAPI to v2.0.7
  • 500a209 Change storageQuota to operate on code units, not bytes
  • 23d67eb Add the storageQuota option
  • b4db242 Remove unused form-data-symbols.js file
  • 70fd739 Fix a few entries in the changelog
  • eae1062 Upgrades cssstyle dependency to ^1.0.0
  • 022c204 Update hosts in Travis configuration
  • 2761d3c HashChangeEvent and PopStateEvent should no longer bubble
  • Additional commits viewable in compare view

Updates socket.io from 4.5.4 to 4.8.3

Release notes

Sourced from socket.io's releases.

socket.io@4.8.3

Bug Fixes

  • do not throw when calling io.close() on a stopped server (9581f9b)

Dependencies

socket.io-client@4.8.3

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

socket.io@4.8.2

The url.parse() function is now deprecated and has been replaced by new URL() (see 8af7019).

Bug Fixes

  • call adapter.init() when creating each namespace (f3e1f5e)
  • improve io.close() function (#5344) (bb0b480)

Dependencies

socket.io-client@4.8.2

Bug Fixes

  • bundle: do not mangle the "_placeholder" attribute (bis) (cdae019)
  • drain queue before emitting "connect" (#5259) (d19928e)

Dependencies

socket.io@4.8.1

Due to a change in the bundler configuration, the production bundle (socket.io.min.js) did not support sending and receiving binary data in version 4.8.0. This is now fixed.

Dependencies

... (truncated)

Commits
  • 9978574 chore(release): socket.io@4.8.3
  • e9e5bed chore(release): socket.io-client@4.8.3
  • 9581f9b fix(sio): do not throw when calling io.close() on a stopped server
  • 579d43f refactor: remove unused files
  • ee9aac3 chore(release): socket.io-parser@4.2.5
  • 968277c chore(release): socket.io-adapter@2.5.6
  • 2bf16bd chore(release): engine.io-client@6.6.4
  • ad61607 docs(eio): fix link in the release notes
  • dd71792 chore(release): socket.io@4.8.2
  • bb0b480 fix(sio): improve io.close() function (#5344)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io since your current version.


Updates engine.io-client from 6.6.4 to 6.6.6

Release notes

Sourced from engine.io-client's releases.

engine.io-client@6.6.6

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

Bug Fixes

Dependencies

engine.io-client@6.6.5

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Dependencies

Commits
  • 22cc483 chore(release): engine.io-client@6.6.6
  • 9dbec81 chore(release): engine.io@6.6.9
  • 3ad4e1f docs: improve example with PM2
  • 0e5afee docs: add example with PM2
  • eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
  • c17890c docs: add documentation about WebTransport
  • 20df6ae docs(examples): add client-side load balancing example
  • 16d1923 ci(publish): enable staged publishing
  • ad48a9b docs(examples): add example with HTTP/2
  • 190572d refactor(eio-client): remove XMLHttpRequest from the definition file
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): Bump ws, jsdom, socket.io and engine.io-client
d4b609b 
Bumps [ws](https://github.com/websockets/ws) to 7.5.11 and updates ancestor dependencies [ws](https://github.com/websockets/ws), [jsdom](https://github.com/jsdom/jsdom), [socket.io](https://github.com/socketio/socket.io) and [engine.io-client](https://github.com/socketio/socket.io). These dependencies need to be updated together.


Updates `ws` from 7.5.10 to 7.5.11
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.10...7.5.11)

Updates `jsdom` from 11.11.0 to 11.12.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Changelog](https://github.com/jsdom/jsdom/blob/v11.12.0/Changelog.md)
- [Commits](jsdom/jsdom@v11.11.0...v11.12.0)

Updates `socket.io` from 4.5.4 to 4.8.3
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/4.5.4...socket.io@4.8.3)

Updates `engine.io-client` from 6.6.4 to 6.6.6
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/engine.io-client@6.6.4...engine.io-client@6.6.6)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 7.5.11
  dependency-type: indirect
- dependency-name: jsdom
  dependency-version: 11.12.0
  dependency-type: direct:production
- dependency-name: socket.io
  dependency-version: 4.8.3
  dependency-type: direct:production
- dependency-name: engine.io-client
  dependency-version: 6.6.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants