Bug Fixes

• cleanup pending acks on timeout to prevent memory leak (37aad11)
• prevent uWebSockets.js from serving missing client files (dfb5ab3)
• reject stateful regexps for dynamic namespaces (59f4f24)
• types: allow emitWithAck() for events with void callbacks (#5453) (8b93a18)
• types: properly import http module (74599a6)

Dependencies

• engine.io@~6.6.0 (no change)
• ws@~8.21.0 (diff)

Bug Fixes

• types: export ExtendedError for connect_error event (#5548) (c0d5450)
• types: export reserved event interfaces (#5533) (03945df)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.21.0 (diff)

Bug Fixes

• types: export reserved event interfaces (#5533) (ced7dfd)
• restore default transport resolution (3df3fed)

Dependencies

• ws@~8.21.0 (no change)

Bug Fixes

• refresh ping timeout on incoming packets (da008a5)

Dependencies

• ws@~8.21.0 (no change)

Bug Fixes

• guard client lookups against prototype pollution (830e364)
• properly export options (37f8a32)
• properly handle upgrade failures (7a33d9b)
• skip side effects when lock acquisition fails (1d4269c)

Diff: https://github.com/socketio/socket.io/compare/@socket.io/[email protected][email protected]/[email protected]

Bug Fixes

• reject protocol mismatch for existing sessions (86db1fc)
• restore compatibility with Node.js 10 (ae7fb46)
• run the polling write callback when the client aborts a compressed response (#5540) (915a3ed)

Performance Improvements

• optimize polling request body buffering (dcbd961)
• stream compressed polling responses (91dd763)

Dependencies

• ws@~8.21.0 (no change)

Bug Fixes

• reject binary packets with zero attachments (9c6323e)

Bug Fixes

• honor toJSON() when deconstructing a binary packet (#5518) (57f1114)
• reject binary packets with zero attachments (7c6ef57)

New Contributors

• @spokodev made their first contribution in #5518

Bug Fixes

• reject binary packets with zero attachments (ced94ff)

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.