Gathering detailed insights and metrics for socket.io
Gathering detailed insights and metrics for socket.io
Realtime application framework (Node.JS server)
Installations
npm install socket.ioScore
96
Supply Chain
98.9
Quality
84.2
Maintenance
100
Vulnerability
100
License
Releases
72
socket.io@4.8.1
socket.io@4.8.1
Published on 25 Oct 2024
socket.io-client@4.8.1
socket.io-client@4.8.1
Published on 25 Oct 2024
engine.io-client@6.6.2
engine.io-client@6.6.2
Published on 25 Oct 2024
engine.io@6.6.2
engine.io@6.6.2
Published on 09 Oct 2024
socket.io@4.8.0
socket.io@4.8.0
Published on 21 Sept 2024
socket.io-client@4.8.0
socket.io-client@4.8.0
Published on 21 Sept 2024
Developer
Developer Guide
BETA
Module System
CommonJS, ESM
Min. Node Version
>=10.2.0
Typescript Support
Yes
Node Version
20.18.0
NPM Version
10.8.2
Statistics
61,272 Stars
7,605 Commits
10,125 Forks
1,521 Watching
24 Branches
388 Contributors
Updated on 28 Nov 2024
Bundle Size
262.17 kB
Minified
56.53 kB
Minified + Gzipped
Languages
TypeScript (62.21%)
JavaScript (37.64%)
Shell (0.1%)
HTML (0.03%)
CSS (0.02%)
Total Downloads
Cumulative downloads
Total Downloads
1,530,458,596
Last day
-2.1%
1,218,683
Compared to previous day
Last week
4%
7,078,047
Compared to previous week
Last month
11.9%
29,226,412
Compared to previous month
Last year
9.9%
290,486,484
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Versions
socket.io
Getting Started
Please check our documentation here.
Questions
Our issues list is exclusively reserved for bug reports and feature requests. For usage questions, please use the following resources:
- read our documentation
- check our troubleshooting guide
- look for/ask questions on Stack Overflow
- create a new discussion
Security
If you think that you have found a security vulnerability in our project, please do not create an issue in this GitHub repository, but rather refer to our Security Policy.
Issues and contribution
Please make sure to read our Contributing Guide before creating an issue or making a pull request.
Thanks to everyone who has already contributed to Socket.IO!
License
Stable Version
The latest stable version of the package.
Stable Version
4.8.1
HIGH
1
HIGH
7.5/10
Summary
Insecure randomness in socket.io
Affected Versions
<= 0.9.6
Patched Versions
0.9.7
MODERATE
3
MODERATE
7.3/10
Summary
socket.io has an unhandled 'error' event
Affected Versions
>= 3.0.0, < 4.6.2
Patched Versions
4.6.2
MODERATE
7.3/10
Summary
socket.io has an unhandled 'error' event
Affected Versions
< 2.5.0
Patched Versions
2.5.1
MODERATE
4.3/10
Summary
CORS misconfiguration in socket.io
Affected Versions
< 2.4.0
Patched Versions
2.4.0
Reason
30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish.yml:12
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/publish.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/build-examples.yml:8
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci-browser.yml:14
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:12
- Warn: no topLevel permission defined: .github/workflows/publish.yml:1
- Info: no jobLevel write permissions found
Reason
binaries present in source code
Details
- Warn: binary detected: examples/ReactNativeExample/android/gradle/wrapper/gradle-wrapper.jar:1
Reason
dependency not pinned by hash detected -- score normalized to 1
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-examples.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/build-examples.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-examples.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/build-examples.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-browser.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/ci-browser.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-browser.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/ci-browser.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/ci.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/ci.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/publish.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/socketio/socket.io/publish.yml/main?enable=pin
- Warn: containerImage not pinned by hash: examples/cluster-haproxy/server/Dockerfile:1: pin your Docker image by updating node:14-alpine to node:14-alpine@sha256:434215b487a329c9e867202ff89e704d3a75e554822e07f3e0c0f9e606121b33
- Warn: containerImage not pinned by hash: examples/cluster-httpd/server/Dockerfile:1: pin your Docker image by updating node:14-alpine to node:14-alpine@sha256:434215b487a329c9e867202ff89e704d3a75e554822e07f3e0c0f9e606121b33
- Warn: containerImage not pinned by hash: examples/cluster-nginx/client/Dockerfile:1: pin your Docker image by updating node:14-alpine to node:14-alpine@sha256:434215b487a329c9e867202ff89e704d3a75e554822e07f3e0c0f9e606121b33
- Warn: containerImage not pinned by hash: examples/cluster-nginx/server/Dockerfile:1: pin your Docker image by updating node:14-alpine to node:14-alpine@sha256:434215b487a329c9e867202ff89e704d3a75e554822e07f3e0c0f9e606121b33
- Warn: containerImage not pinned by hash: examples/cluster-traefik/server/Dockerfile:1: pin your Docker image by updating node:14-alpine to node:14-alpine@sha256:434215b487a329c9e867202ff89e704d3a75e554822e07f3e0c0f9e606121b33
- Warn: containerImage not pinned by hash: examples/connection-state-recovery-example/cjs/.codesandbox/Dockerfile:1: pin your Docker image by updating node:20-bullseye to node:20-bullseye@sha256:74ad23a4ae13681054b3ea9f7c05e891b0c0e9c856b948e0628fba70973583da
- Warn: containerImage not pinned by hash: examples/connection-state-recovery-example/esm/.codesandbox/Dockerfile:1: pin your Docker image by updating node:20-bullseye to node:20-bullseye@sha256:74ad23a4ae13681054b3ea9f7c05e891b0c0e9c856b948e0628fba70973583da
- Warn: npmCommand not pinned by hash: examples/cluster-haproxy/server/Dockerfile:9
- Warn: npmCommand not pinned by hash: examples/cluster-httpd/server/Dockerfile:9
- Warn: npmCommand not pinned by hash: examples/cluster-nginx/client/Dockerfile:9
- Warn: npmCommand not pinned by hash: examples/cluster-nginx/server/Dockerfile:9
- Warn: npmCommand not pinned by hash: examples/cluster-traefik/server/Dockerfile:9
- Warn: npmCommand not pinned by hash: .github/workflows/build-examples.yml:44
- Info: 0 out of 8 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 7 containerImage dependencies pinned
- Info: 3 out of 9 npmCommand dependencies pinned
Reason
Found 2/30 approved changesets -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 2 are checked with a SAST tool
Reason
45 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-vp56-6g26-6827
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-mpg4-rc92-vx8v
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986
- Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6
- Warn: Project is vulnerable to: GHSA-hpx4-r86g-5jrg
- Warn: Project is vulnerable to: GHSA-prr3-c3m5-p7q2
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
- Warn: Project is vulnerable to: GHSA-q9mw-68c2-j6m5
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
- Warn: Project is vulnerable to: GHSA-cqmj-92xf-r6r9
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-hc6q-2mpp-qw7j
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-9vvw-cc9w-f27h
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-wrvr-8mpx-r7pp
- Warn: Project is vulnerable to: GHSA-hxm2-r34f-qmc5
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m / GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-w9mr-4mfr-499f
- Warn: Project is vulnerable to: GHSA-qg8p-v9q4-gh34
- Warn: Project is vulnerable to: GHSA-g4rg-993r-mgx7
- Warn: Project is vulnerable to: GHSA-34r7-q49f-h37c
- Warn: Project is vulnerable to: GHSA-c9f4-xj24-8jqx
Score
5.7
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More