4 people 5dccf3b62c [Security upgrade] bump socket.io-client fork to ws@^8.21.0 (#35060) ...

* bump socket.io-client to overleaf fork 0.9.17-overleaf-6

Fixes GHSA-96hv-2xvq-fx4p (ws memory exhaustion DoS) by bumping the
overleaf/socket.io-client fork to a version that declares ws@^8.21.0
instead of ws@^1.1.5. The existing ws@npm:^8 resolution pins it to
8.21.0, removing ws@1.1.5 from yarn.lock entirely.

Depends on overleaf/socket.io-client#6.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* use 0.9.17-overleaf-6 tag for socket.io-client

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* use the socket.io-client-0.9.17-overleaf-6 release

* provide ws module for real-time acceptance tests

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 2d9a42f90bcf95a3a8f053df4c0092c4fbc26422

2026-09-17 11:15:42 +00:00

..

app/js

[real-time] gracefully handle undefined meta.tc (#35049)

2026-09-17 11:15:38 +00:00

config

Merge pull request #30215 from overleaf/ar/convert-real-time-to-esm

2026-01-13 09:06:30 +00:00

test

Merge pull request #33361 from overleaf/copilot/remove-direct-use-of-body-parser

2026-09-17 11:14:46 +00:00

.mocharc.cjs

use require.resolve for mocha reporter paths (#34235)

2026-06-05 08:06:46 +00:00

app.js

Handle ERR_STREAM_UNABLE_TO_PIPE alongside ERR_STREAM_PREMATURE_CLOSE (#31174)

2026-02-03 09:05:50 +00:00

LICENSE

Add correct license

2020-12-03 10:27:38 +00:00

package.json

[Security upgrade] bump socket.io-client fork to ws@^8.21.0 (#35060)

2026-09-17 11:15:42 +00:00

tsconfig.json

Merge pull request #30215 from overleaf/ar/convert-real-time-to-esm

2026-01-13 09:06:30 +00:00

vitest.config.unit.cjs

Merge pull request #30215 from overleaf/ar/convert-real-time-to-esm

2026-01-13 09:06:30 +00:00