lean-poker / boardgame.io / 25905891812

100%

Build Type

push

github

Committed by devill

Commit Message

fix(server): drop koa-socket-2; mount socket.io@4 directly on http.Server

koa-socket-2 (unmaintained since 2019) pinned socket.io 3.x transitively,
surfacing advisories via engine.io's cookie<0.7 and ws 7.x DoS, and via
socket.io-parser 4.0–4.2.5. socket.io@4 is already a direct dep; the
wrapper's only real job was creating an http.Server from app.callback()
and patching app.listen. SocketIO transport now creates the http(s).Server
itself, hands it to new IOServer(), and exposes it via transport.server
so Server.run() listens on the right server. Drive-by: cors.origins (a
silent no-op under v4) is now cors.origin so the option is actually
honoured.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Coverage Stats

1784 of 1786 branches covered (99.89%)

Branch coverage included in aggregate %.

10 of 11 new or added lines in 2 files covered. (90.91%)

1 existing line in 1 file now uncovered.

2669 of 2673 relevant lines covered (99.85%)

28590.78 hits per line