[Snyk] Security upgrade socket.io-client from 2.4.0 to 4.8.0

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-WS-17988732	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[snyk-io]

This is a major upgrade from version 2.x to 4.x, which includes significant breaking changes primarily introduced in the v3.0 release. A simple version bump is not possible and will require code modifications and a coordinated server-side update.

Key Breaking Changes:

• Protocol Incompatibility: The underlying communication protocol changed between v2 and v3. A v2 client cannot connect to a v3/v4 server, and a v3/v4 client cannot connect to a v2 server. [4] The server can enable a compatibility mode (allowEIO3: true) to allow v2 clients, but upgrading both client and server is the recommended path. [2, 4]
• Authentication Option Renamed: The client connection option query has been renamed to auth. Any credentials or tokens previously passed in query must be moved to the auth object. [8]
• Manager Events: Events related to the connection state (e.g., reconnect_attempt, reconnect_error) are no longer emitted on the socket instance. You must now listen for them on the manager instance, which is accessible via socket.io(). [8]
• pong Event Removed: The client-side pong event, used for measuring latency, has been removed due to a change in the heartbeat mechanism. [4, 8]
• Dropped Environment Support: Support for Node.js 8 and Internet Explorer 8 was dropped in v3.0. [4]

Migration from v3 to v4:
The upgrade from v3 to v4 is less impactful on the client-side, as the protocol is compatible. [1, 2] The breaking changes in v4 were primarily on the server API. [3, 5]

Recommendation:
This upgrade must be handled with care. Developers need to update their client-side initialization code to reflect the API changes and ensure the server is running a compatible version (v3 or v4). Review the official migration guides before proceeding.

Source:

• Migrating from 2.x to 3.0 [4]
• Migrating from 3.x to 4.0 [2]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.