chore(webapp,supervisor,core): move socket.io to 4.8.3 (#4635)

## Summary `socket.io` was pinned at exactly `4.7.4` in three manifests (`apps/webapp`, `apps/supervisor`, `packages/core`). That pin capped `engine.io` at 6.5.4, because 4.7.4 declares `engine.io: ~6.5.2`. Moving all three pins to `4.8.3` lifts that cap: 4.8.3 declares `engine.io: ~6.6.0`. The webapp's direct `engine.io` devDependency moves from `^6.5.4` to `^6.6.7` to match. These are direct dependencies, so they are bumped in place rather than forced with an override. ## Result The tree previously carried two `engine.io` copies. It now carries one: ``` engine.io@6.6.8 └─┬ socket.io@4.8.3 ├── @trigger.dev/core (dependencies) ├─┬ react-email │ └── emails (devDependencies) ├── supervisor (dependencies) └── webapp (dependencies) ``` `react-email` was already resolving `socket.io@4.8.3` in this same tree, so that combination was already running here before this change. ## Servers move, clients do not This bumps `socket.io` (the server) only. `socket.io-client` stays at `4.7.5` in `packages/core` and `packages/cli-v3`, deliberately: the fix is server-side, and clients ship inside user deployments, so leaving them alone keeps the blast radius small. That means a 4.8.3 server will be talking to 4.7.5 clients indefinitely, which is worth being explicit about. That pairing is safe because neither wire protocol changed. Both versions report the same protocol numbers: | | 4.7.4 | 4.8.3 | | --- | --- | --- | | Socket.IO protocol (`socket.io-parser`) | 5 | 5 | | Engine.IO protocol (`engine.io-parser`) | 4 | 4 | The version bump moves `socket.io-parser` 4.2.6 to 4.2.7 and `engine.io` 6.5.4 to 6.6.8, but the protocol constants each exports are unchanged. The 4.8.0 changes are additive on the client (custom transport implementations, a `tryAllTransports` option) and bug fixes on the server. Verified rather than assumed, with a cross-version matrix covering both transports and both directions: ``` PASS server 4.8.3 <- client 4.7.5 websocket / polling PASS server 4.8.3 <- client 4.8.3 websocket / polling PASS server 4.7.4 <- client 4.7.5 websocket / polling PASS server 4.7.4 <- client 4.8.3 websocket / polling ``` Each case exercised connect, a server-initiated emit, `emitWithAck`, room join, room broadcast, and a binary payload. Compatibility holds in both directions, so there is no upgrade-ordering requirement between server and client. `pnpm run typecheck` passes across all 57 workspaces. Stacked on #4634.
2026-08-16 21:11:34 +01:00
parent 869156e3b8
commit 148615b526
4 changed files with 14 additions and 64 deletions
@@ -21,7 +21,7 @@
    "ioredis": "~5.6.0",
    "p-limit": "^6.2.0",
    "prom-client": "^15.1.0",
-    "socket.io": "4.7.4",
+    "socket.io": "4.8.3",
    "std-env": "^3.8.0",
    "zod": "3.25.76"
  },
@@ -209,7 +209,7 @@
    "semver": "^7.5.0",
    "simplur": "^3.0.1",
    "slug": "^6.0.0",
-    "socket.io": "4.7.4",
+    "socket.io": "4.8.3",
    "socket.io-adapter": "^2.5.4",
    "sonner": "^1.0.3",
    "sql-formatter": "^15.4.10",
@@ -264,7 +264,7 @@
    "autoevals": "^0.0.130",
    "css-loader": "^6.10.0",
    "datepicker": "link:@types/@react-aria/datepicker",
-    "engine.io": "^6.5.4",
+    "engine.io": "^6.6.7",
    "esbuild": "^0.15.10",
    "evalite": "1.0.0-beta.16",
    "postcss-import": "^16.0.1",
@@ -224,7 +224,7 @@
    "jose": "^5.4.0",
    "nanoid": "3.3.8",
    "prom-client": "^15.1.0",
-    "socket.io": "4.7.4",
+    "socket.io": "4.8.3",
    "socket.io-client": "4.7.5",
    "std-env": "^3.8.1",
    "tinyexec": "^0.3.2",
@@ -189,8 +189,8 @@ importers:
        specifier: ^15.1.0
        version: 15.1.0
      socket.io:
-        specifier: 4.7.4
-        version: 4.7.4(bufferutil@4.0.9)
+        specifier: 4.8.3
+        version: 4.8.3(bufferutil@4.0.9)
      std-env:
        specifier: ^3.8.0
        version: 3.8.1
@@ -754,8 +754,8 @@ importers:
        specifier: ^6.0.0
        version: 6.1.0
      socket.io:
-        specifier: 4.7.4
-        version: 4.7.4(bufferutil@4.0.9)
+        specifier: 4.8.3
+        version: 4.8.3(bufferutil@4.0.9)
      socket.io-adapter:
        specifier: ^2.5.4
        version: 2.5.4(bufferutil@4.0.9)
@@ -914,8 +914,8 @@ importers:
        specifier: link:@types/@react-aria/datepicker
        version: link:@types/@react-aria/datepicker
      engine.io:
-        specifier: ^6.5.4
-        version: 6.5.4(bufferutil@4.0.9)
+        specifier: ^6.6.7
+        version: 6.6.8(bufferutil@4.0.9)
      esbuild:
        specifier: ^0.15.10
        version: 0.15.18
@@ -1149,7 +1149,7 @@ importers:
        version: 18.2.7
      react-email:
        specifier: ^6.5.0
-        version: 6.5.0(bufferutil@4.0.9)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        version: 6.5.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1)

  internal-packages/llm-model-catalog:
    dependencies:
@@ -1952,8 +1952,8 @@ importers:
        specifier: ^15.1.0
        version: 15.1.0
      socket.io:
-        specifier: 4.7.4
-        version: 4.7.4(bufferutil@4.0.9)
+        specifier: 4.8.3
+        version: 4.8.3(bufferutil@4.0.9)
      socket.io-client:
        specifier: 4.7.5
        version: 4.7.5(bufferutil@4.0.9)(supports-color@10.0.0)
@@ -7911,9 +7911,6 @@ packages:
  '@types/connect@3.4.38':
    resolution: {integrity: sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==}

-  '@types/cookie@0.4.1':
-    resolution: {integrity: sha512-XW/Aa8APYr6jSVVA1y/DEIZX0/GMKLEVekNG727R8cs56ahETkRAy/3DR7+fJyh7oUgGwNQaRfXCun0+KbWY7Q==}
-
  '@types/cookie@0.6.0':
    resolution: {integrity: sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==}

@@ -9590,10 +9587,6 @@ packages:
    resolution: {integrity: sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==}
    engines: {node: '>=6.6.0'}

-  cookie@0.4.2:
-    resolution: {integrity: sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==}
-    engines: {node: '>= 0.6'}
-
  cookie@0.6.0:
    resolution: {integrity: sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==}
    engines: {node: '>= 0.6'}
@@ -10384,10 +10377,6 @@ packages:
    resolution: {integrity: sha512-RcyUFKA93/CXH20l4SoVvzZfrSDMOTUS3bWVpTt2FuFP+XYrL8i8oonHP7WInRyVHXh0n/ORtoeiE1os+8qkSw==}
    engines: {node: '>=10.0.0'}

-  engine.io@6.5.4:
-    resolution: {integrity: sha512-KdVSDKhVKyOi+r5uEabrDLZw2qXStVvCsEB/LN3mw4WFi6Gx50jTyuxYVCwAAC0U46FdnzP/ScKRBTXb/NiEOg==}
-    engines: {node: '>=10.2.0'}
-
  engine.io@6.6.8:
    resolution: {integrity: sha512-2agL3ueZhqxoVrfmntO8yuVj+uNSlIOnhykYHk3Cq0ShYPdUjjUiSJrQvXjq01I9jAuI0Zl2YO8Evv5Mqytm5g==}
    engines: {node: '>=10.2.0'}
@@ -14528,10 +14517,6 @@ packages:
    resolution: {integrity: sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==}
    engines: {node: '>=10.0.0'}

-  socket.io@4.7.4:
-    resolution: {integrity: sha512-DcotgfP1Zg9iP/dH9zvAQcWrE0TtbMVwXmlV4T4mqsvY+gw+LqUGPfx2AoVyRk0FLME+GQhufDMyacFmw7ksqw==}
-    engines: {node: '>=10.2.0'}
-
  socket.io@4.8.3:
    resolution: {integrity: sha512-2Dd78bqzzjE6KPkD5fHZmDAKRNe3J15q+YHDrIsy9WEkqttc7GY+kT9OBLSMaPbQaEd0x1BjcmtMtXkfpc+T5A==}
    engines: {node: '>=10.2.0'}
@@ -22765,8 +22750,6 @@ snapshots:
    dependencies:
      '@types/node': 24.13.3

-  '@types/cookie@0.4.1': {}
-
  '@types/cookie@0.6.0': {}

  '@types/cookiejar@2.1.5': {}
@@ -24553,8 +24536,6 @@ snapshots:

  cookie-signature@1.2.2: {}

-  cookie@0.4.2: {}
-
  cookie@0.6.0: {}

  cookie@0.7.1: {}
@@ -25279,23 +25260,6 @@ snapshots:

  engine.io-parser@5.2.2(patch_hash=9011e7e16547017450c9baec0fceff0e070310c20d9e62f8d1383bb1da77104f): {}

-  engine.io@6.5.4(bufferutil@4.0.9):
-    dependencies:
-      '@types/cookie': 0.4.1
-      '@types/cors': 2.8.17
-      '@types/node': 24.13.3
-      accepts: 1.3.8
-      base64id: 2.0.0
-      cookie: 0.4.2
-      cors: 2.8.5
-      debug: 4.3.4
-      engine.io-parser: 5.2.2(patch_hash=9011e7e16547017450c9baec0fceff0e070310c20d9e62f8d1383bb1da77104f)
-      ws: 8.21.0(bufferutil@4.0.9)
-    transitivePeerDependencies:
-      - bufferutil
-      - supports-color
-      - utf-8-validate
-
  engine.io@6.6.8(bufferutil@4.0.9):
    dependencies:
      '@types/cors': 2.8.17
@@ -29456,7 +29420,7 @@ snapshots:
      react: 18.3.1
      react-dom: 18.3.1(react@18.3.1)

-  react-email@6.5.0(bufferutil@4.0.9)(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+  react-email@6.5.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
    dependencies:
      '@babel/parser': 7.27.0
      '@babel/traverse': 7.27.0
@@ -30439,20 +30403,6 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

-  socket.io@4.7.4(bufferutil@4.0.9):
-    dependencies:
-      accepts: 1.3.8
-      base64id: 2.0.0
-      cors: 2.8.5
-      debug: 4.3.7(supports-color@10.0.0)
-      engine.io: 6.5.4(bufferutil@4.0.9)
-      socket.io-adapter: 2.5.4(bufferutil@4.0.9)
-      socket.io-parser: 4.2.7(supports-color@10.0.0)
-    transitivePeerDependencies:
-      - bufferutil
-      - supports-color
-      - utf-8-validate
-
  socket.io@4.8.3(bufferutil@4.0.9):
    dependencies:
      accepts: 1.3.8