Version 2.5.0

June 26, 2022

Server

⚠️ WARNING ⚠️

The default value of the maxHttpBufferSize option has been decreased from 100 MB to 1 MB, in order to prevent attacks by denial of service.

Security advisory: GHSA-j4f2-536g-r55m

Bug Fixes

• fix race condition in dynamic namespaces (05e1278)
• ignore packet received after disconnection (22d4bdf)
• only set 'connected' to true after middleware execution (226cc16)
• prevent the socket from joining a room after disconnection (f223178)

Dependencies

• engine.io@~3.6.0 (https://github.com/socketio/engine.io/compare/3.5.0...3.6.0)
• ws@~7.4.2 (no change)

Client

Bug Fixes

• ensure buffered events are sent in order (991eb0b)

Dependencies

• engine.io-client@~3.5.0 (no change)
• ws@~7.4.2 (no change)