socket.io
socket.io (latest known version: 6.6.9) has 9 known breaking changes on record, each backed by a source URL.
Security advisories
Recent changes
Version engine.io@6.6.1 is a semver-major release over engine.io-parser@5.2.3, but no breaking change was detected in the release notes text - flagged for manual review.
Version engine.io-parser@5.2.3 is a semver-major release over socket.io-client@4.8.3, but no breaking change was detected in the release notes text - flagged for manual review.
* `io.to(...)` now returns an immutable operator Previously, broadcasting to a given room (by calling `io.to()`) would mutate the io instance, which could lead to surprising behaviors, like: ```js io.to("room1"); io.to("room2").emit(/* ... */); // also sent to room1 // or with async/await io.to("room3").emit("details", await fetchDetails()); // random behavior: maybe in room3, maybe to all clients ``` Calling `io.to()` (or any other broadcast modifier) will now return an immutable instance.
* the 'origins' option is removed Before: ```js new Server(3000, { origins: ["https://example.com"] }); ``` The 'origins' option was used in the allowRequest method, in order to determine whether the request should pass or not. And the Engine.IO server would implicitly add the necessary Access-Control-Allow-xxx headers. After: ```js new Server(3000, { cors: { origin: "https://example.com", methods: ["GET", "POST"], allowedHeaders: ["content-type"] } }); ``` The already existing 'allowRequest' option can be used for validation: ```js new Server(3000, { allowRequest: (req, callback) => { callback(null, req.headers.referer.startsWith("https://example.com")); } }); ``` * `Socket#rooms` is now a Set instead of an object * `Namespace#connected` is now a Map instead of an object * there is no more implicit connection to the default namespace: ```js // client-side const socket = io("/admin"); // server-side io.on("connect", socket => { // not triggered anymore }) io.use((socket, next) => { // not triggered anymore }); io.of("/admin").use((socket, next) => { // triggered }); ``` * the `Server#set()` method was removed This method was kept for backward-compatibility with pre-1.0 versions.
* the "connected" map is renamed to "sockets" * the Socket#binary() method is removed, as this use case is now covered by the ability to provide your own parser.
* the Socket#use() method is removed (see [5c73733](https://github.com/socketio/socket.io/commit/5c737339858d59eab4b5ee2dd6feff0e82c4fe5a)) * Socket#join() and Socket#leave() do not accept a callback argument anymore. Before: ```js socket.join("room1", () => { io.to("room1").emit("hello"); }); ``` After: ```js socket.join("room1"); io.to("room1").emit("hello"); // or await socket.join("room1"); for custom adapters ```
* the Socket#use() method is removed (see [5c73733](https://github.com/socketio/socket.io/commit/5c737339858d59eab4b5ee2dd6feff0e82c4fe5a)) * Socket#join() and Socket#leave() do not accept a callback argument anymore. Before: ```js socket.join("room1", () => { io.to("room1").emit("hello"); }); ``` After: ```js socket.join("room1"); io.to("room1").emit("hello"); // or await socket.join("room1"); for custom adapters ``` * the "connected" map is renamed to "sockets" * the Socket#binary() method is removed, as this use case is now covered by the ability to provide your own parser. * the 'origins' option is removed Before: ```js new Server(3000, { origins: ["https://example.com"] }); ``` The 'origins' option was used in the allowRequest method, in order to determine whether the request should pass or not. And the Engine.IO server would implicitly add the necessary Access-Control-Allow-xxx headers. After: ```js new Server(3000, { cors: { origin: "https://example.com", methods: ["GET", "POST"], allowedHeaders: ["content-type"] } }); ``` The already existing 'allowRequest' option can be used for validation: ```js new Server(3000, { allowRequest: (req, callback) => { callback(null, req.headers.referer.startsWith("https://example.com")); } }); ``` * Socket#rooms is now a Set instead of an object * Namespace#connected is now a Map instead of an object * there is no more implicit connection to the default namespace: ```js // client-side const socket = io("/admin"); // server-side io.on("connect", socket => { // not triggered anymore }) io.use((socket, next) => { // not triggered anymore }); io.of("/admin").use((socket, next) => { // triggered }); ``` * the Server#set() method was removed This method was kept for backward-compatibility with pre-1.0 versions.
Version 2.0.0 is a semver-major release over 1.7.4, but no breaking change was detected in the release notes text - flagged for manual review.
Version 1.5.0 is a semver-major release over 0.9.19, but no breaking change was detected in the release notes text - flagged for manual review.
Check what changed for socket.io since your installed version, live.
Open the playground →