lean-poker / boardgame.io / 25905891812 / 1

100%

main: 100%

push

github

fix(server): drop koa-socket-2; mount socket.io@4 directly on http.Server

koa-socket-2 (unmaintained since 2019) pinned socket.io 3.x transitively,
surfacing advisories via engine.io's cookie<0.7 and ws 7.x DoS, and via
socket.io-parser 4.0–4.2.5. socket.io@4 is already a direct dep; the
wrapper's only real job was creating an http.Server from app.callback()
and patching app.listen. SocketIO transport now creates the http(s).Server
itself, hands it to new IOServer(), and exposes it via transport.server
so Server.run() listens on the right server. Drive-by: cors.origins (a
silent no-op under v4) is now cors.origin so the option is actually
honoured.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

1880 of 1882 branches covered (99.89%)

Branch coverage included in aggregate %.

5338 of 5346 relevant lines covered (99.85%)

14295.39 hits per line