build(deps): Bump engine.io from 6.4.1 to 6.5.0

[dependabot]

Bumps engine.io from 6.4.1 to 6.5.0.

Release notes

Sourced from engine.io's releases.

6.5.0

Bug Fixes

• uws: discard any write to an aborted uWS response (#682) (3144d27)

Features

Support for WebTransport

The Engine.IO server can now use WebTransport as the underlying transport.

WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

References:

• https://w3c.github.io/webtransport/
• https://developer.mozilla.org/en-US/docs/Web/API/WebTransport
• https://developer.chrome.com/articles/webtransport/

Until WebTransport support lands in Node.js, you can use the @fails-components/webtransport package:

import { readFileSync } from "fs";
import { createServer } from "https";
import { Server } from "engine.io";
import { Http3Server } from "@fails-components/webtransport";
// WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)
const cert = readFileSync("/path/to/my/cert.pem");
const key = readFileSync("/path/to/my/key.pem");
const httpsServer = createServer({
key,
cert
});
httpsServer.listen(3000);
const engine = new Server({
transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
});
engine.attach(httpsServer);
const h3Server = new Http3Server({
port: 3000,
host: "0.0.0.0",
secret: "changeit",
cert,
</tr></table>

... (truncated)

Changelog

Sourced from engine.io's changelog.

6.5.0 (2023-06-16)

Bug Fixes

• uws: discard any write to an aborted uWS response (#682) (3144d27)

Features

Support for WebTransport

The Engine.IO server can now use WebTransport as the underlying transport.

WebTransport is a web API that uses the HTTP/3 protocol as a bidirectional transport. It's intended for two-way communications between a web client and an HTTP/3 server.

References:

• https://w3c.github.io/webtransport/
• https://developer.mozilla.org/en-US/docs/Web/API/WebTransport
• https://developer.chrome.com/articles/webtransport/

Until WebTransport support lands in Node.js, you can use the @fails-components/webtransport package:

import { readFileSync } from "fs";
import { createServer } from "https";
import { Server } from "engine.io";
import { Http3Server } from "@fails-components/webtransport";
// WARNING: the total length of the validity period MUST NOT exceed two weeks (https://w3c.github.io/webtransport/#custom-certificate-requirements)
const cert = readFileSync("/path/to/my/cert.pem");
const key = readFileSync("/path/to/my/key.pem");
const httpsServer = createServer({
key,
cert
});
httpsServer.listen(3000);
const engine = new Server({
transports: ["polling", "websocket", "webtransport"] // WebTransport is not enabled by default
});
engine.attach(httpsServer);
const h3Server = new Http3Server({
port: 3000,
host: "0.0.0.0",
</tr></table>

... (truncated)

Commits

• 1f640a2 chore(release): 6.5.0
• 1bfa9cd refactor: adapt to latest uWebSockets.js changes
• 123b68c feat: add support for WebTransport
• 3144d27 fix(uws): discard any write to an aborted uWS response (#682)
• 7bd7775 docs: update the list of CVE
• 95e2153 chore(release): 6.4.2
• fc480b4 fix: prevent crash when provided with an invalid query param
• 0141951 refactor(types): ensure compatibility with Express middlewares
• 8b22162 fix(uws): prevent crash when using with middlewares
• 9395782 fix: include error handling for Express middlewares (#674)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1718.