4.0.5

No change on the server-side, this matches the client release.

Links

• Diff: 4.0.4...4.0.5
• Client release: 4.0.5
• ws version: ^7.1.2

4.0.4

No change on the server-side, this matches the client release.

Links

• Diff: 4.0.3...4.0.4
• Client release: 4.0.4
• ws version: ^7.1.2

4.0.3

No change on the server-side, this matches the client release.

Links

• Diff: 4.0.2...4.0.3
• Client release: 4.0.3
• ws version: ^7.1.2

4.0.2

Bug Fixes

• add extension in the package.json main entry (#608) (17b8c2f)

Links

• Diff: 4.0.1...4.0.2
• Client release: 4.0.2
• ws version: ^7.1.2

4.0.1

Bug Fixes

• do not overwrite CORS headers upon error (fe093ba)

Links

• Diff: 4.0.0...4.0.1
• Client release: 4.0.1
• ws version: ^7.1.2

4.0.0

More details about this release in the blog post: https://socket.io/blog/engine-io-4-release/

Bug Fixes

• ignore errors when forcefully closing the socket (#601) (dcdbccb)
• remove implicit require of uws (82cdca2)

Features

• disable perMessageDeflate by default (078527a)
• decrease the default value of maxHttpBufferSize (734f9d1)
• disable cookie by default and add sameSite attribute (a374471), closes /github.com/jshttp/cookie#options-1
• generateId method can now return a Promise (f3c291f)
• reverse the ping-pong mechanism (31ff875)
• use the cors module to handle cross-origin requests (61b9492)

Links

• Diff: v4.0.0-alpha.1...4.0.0
• Full diff: 3.4.0...4.0.0
• Client release: 4.0.0
• ws version: ^7.1.2

3.4.2

Bug Fixes

• remove explicit require of uws (85e544a)

Links

• Diff: 3.4.1...3.4.2
• Client release: -
• ws version: ^7.1.2

3.4.1

Bug Fixes

• ignore errors when forcefully closing the socket (da851ec)
• use SameSite=Strict by default (001ca62)

Links

• Diff: 3.4.0...3.4.1
• Client release: 3.4.1
• ws version: ^7.1.2

v4.0.0-alpha.1

Links

• Diff: v4.0.0-alpha.0...v4.0.0-alpha.1
• Client release: v4.0.0-alpha.1
• ws version: ^7.1.2

v4.0.0-alpha.0

Features

• decrease the default value of maxHttpBufferSize (734f9d1)
• disable cookie by default and add sameSite attribute (a374471), closes /github.com/jshttp/cookie#options-1
• generateId method can now return a Promise (f3c291f)
• reverse the ping-pong mechanism (31ff875)
• use the cors module to handle cross-origin requests (61b9492)

BREAKING CHANGES

• the handlePreflightRequest option is removed by the change.

Before:

new Server({
  handlePreflightRequest: (req, res) => {
    res.writeHead(200, {
      "Access-Control-Allow-Origin": 'https://example.com',
      "Access-Control-Allow-Methods": 'GET',
      "Access-Control-Allow-Headers": 'Authorization',
      "Access-Control-Allow-Credentials": true
    });
    res.end();
  }
})

After:

new Server({
  cors: {
    origin: "https://example.com",
    methods: ["GET"],
    allowedHeaders: ["Authorization"],
    credentials: true
  }
})

• the syntax has changed from

new Server({
  cookieName: "test",
  cookieHttpOnly: false,
  cookiePath: "/custom"
})

to

new Server({
  cookie: {
    name: "test",
    httpOnly: false,
    path: "/custom"
  }
})

All other options (domain, maxAge, sameSite, ...) are now supported.

• v3.x clients will not be able to connect anymore (they will send a ping packet and timeout while waiting for a pong packet).

Links

• Diff: 3.4.0...v4.0.0-alpha.0
• Client release: v4.0.0-alpha.0
• ws version: ^7.1.2