32f368629caece311c21c96014b7ac4c584a11fc707b546661a9d1c7527920c8f68d78021877d47c06c2a403892ab815260d8384019671b1e23ad07fd9368f 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365
  1. 1.6.1
  2. ==
  3. Fixes
  4. * Update `eventsource` to `2.0.2` due to CVE-2022-1650. Fixes #590
  5. * Update `minimist` to `1.2.6`. Fixes #585
  6. 1.6.0
  7. ==
  8. Fixes
  9. * Remove `agent: false` to allow usage of `globalAgent`. Fixes #421
  10. dependencies
  11. * Update `url-parse` due to CVE-2022-0686, CVE-2022-0639, and CVE-2022-0512. Fixes #576
  12. * Remove `json3` dependency. Fixes #476
  13. * Update `eventsource` to `1.1.0`
  14. * Update `faye-websocket` to `0.11.4`
  15. * Update `debug` to `3.2.7`
  16. devDependencies
  17. * Update `follow-redirects` (devDep) due to CVE-2022-0536 and CVE-2022-0155
  18. * Update `karma` (devDep) due to CVE-2022-0437
  19. * Update `cached-path-relative` (devDep) due to CVE-2021-23518
  20. * Update `fsevents` (devDep) to fix:
  21. * `ini` CVE-2020-7788
  22. * `minimist` CVE-2020-7598
  23. * `tar` CVE-2021-37713, CVE-2021-37701, CVE-2021-32804, CVE-2021-32803
  24. * Update `copy-props` (devDep) due to CVE-2020-28503
  25. * Update `eslint`, `mocha`, `gulp-replace`, `karma-browserify`, `gulp-sourcemaps`, and `browserify`
  26. Other Changes
  27. * Remove bower
  28. * Remove Travis CI
  29. * Require Node.js 12
  30. 1.5.2
  31. ==
  32. * Update `url-parse` due to CVE-2021-3664.
  33. 1.5.1
  34. ==
  35. * Update `url-parse` due to CVE-2021-27515.
  36. 1.5.0
  37. ==
  38. * Update `url-parse`, `kind-of`, `minimist`, `websocket-extensions` due to security vulnerabilies.
  39. * Update dev dependencies.
  40. * Allow loopback address hostnames on a secure page. Fixes #486
  41. * Enable eventsource transport for node.js clients.
  42. 1.4.0
  43. ==
  44. * Add `timeout` option to set a minimum transport timeout. Fixes #403
  45. * Update dev deps to fix security warnings from `npm audit`
  46. * Guard against null `this._transport` in `debug` statement. Fixes #448
  47. 1.3.0
  48. ==
  49. * Revert `debug` to `^3` because v4 starts using ES6. Fixes #457
  50. 1.2.0
  51. ==
  52. * Update all outdated dependencies
  53. * Switch to karma and browserstack for running automated browser tests
  54. 1.1.5
  55. ==
  56. * Wrap the the contentWindow access in a try/catch block when in setTimeout #363
  57. * Revised example in README #356
  58. * Fix connection close when Transport timeout #358
  59. * Fixed crash with react-native@0.45.1 on Android #386
  60. * Update jsDelivr link #404, #405
  61. * Remove Sauce Labs unsupported browsers
  62. * Add link to rust server implementation #411
  63. * location.protocol should include final `:` #396
  64. 1.1.4
  65. ==
  66. * Upgrade `debug` and fix object key literal mangling, fixes regression in Opera 11.10 #359
  67. * Trim descriptions in package.json and bower.json - #372
  68. 1.1.3
  69. ==
  70. * Bad publish to NPM (removed)
  71. 1.1.2
  72. ==
  73. * Ensure both sender and receiver are cleaned upon close - #342
  74. * Remove event listeners before calling `close` - #344
  75. * Update documentation links - #351, #339, #316
  76. * Explicitly export `undefined` when `WebSocket` does not exist. Fixes Webpack. #321
  77. * Include `dist` folder on npm - #265
  78. * Simplify build setup
  79. * Update to Node.js 6.9
  80. * Add sourcemap for minified version
  81. * Remove unused String.trim shim
  82. 1.1.1
  83. ==
  84. * Do not pass `protocols` or `options` arguments to browser WebSocket constructor - #309
  85. 1.1.0
  86. ==
  87. * Fix IE7/8 usage of `console.log` which does not have `apply` - #279
  88. * Remove `dbg` global variable - #282
  89. * Bump `faye-websocket` version to `0.11.0` - #267
  90. * Optimize `arguments` usage - #263
  91. * Add sourcemap file to dist folder - #237
  92. * Add way to transparently pass transport-specific options - #272
  93. 1.0.3
  94. ==
  95. * Use `https` module for xhr requests in node when url uses https - #254
  96. 1.0.2
  97. ==
  98. * Fix iframe info receiver url
  99. * Move iframe.contentWindow check inside setTimeout - #246
  100. 1.0.1
  101. ==
  102. * Use proper base url for iframe-based info receiver - #249
  103. * Don't register unload event in chrome packaged app - #223
  104. * Allow custom session ids - #250
  105. * Remove version property from bower.json - #247
  106. * Update example CDN url - #244
  107. 1.0.0
  108. ===
  109. * Simplify url handling by delegating to `url-parse` - #242
  110. * Upgrade to `url-parse` 1.0.1 to fix colon issue if auth has no password
  111. 1.0.0-beta.13
  112. ===
  113. * Transport timeout on connection should fallback - #238
  114. 1.0.0-beta.12
  115. ====
  116. * Upgrade `url-parse` to 1.0.0 to fix #218 again
  117. 1.0.0-beta.10
  118. ====
  119. * Upgrade `url-parse` to 0.2.3 to fix #222
  120. 1.0.0-beta.9
  121. ====
  122. * Upgrade `url-parse` to 0.2.1 to fix 'too much recursion' errors
  123. 1.0.0-beta.8
  124. ====
  125. * Upgrade `url-parse` to 0.2.0 to fix inheritance issues
  126. 1.0.0-beta.7
  127. ====
  128. * Upgrade `url-parse` to 0.1.5 to fix #218
  129. * Don't strip basic auth from url - #219
  130. 1.0.0-beta.6
  131. ====
  132. * Upgrade `url-parse` to 0.1.3 to avoid CSP issues
  133. 1.0.0-beta.5
  134. =====
  135. * Upgrade `url-parse` to 0.1.1 to fix #214
  136. 1.0.0-beta.4
  137. =====
  138. * Upgrade `url-parse` to 0.1.0 and `sockjs` to 0.3.11
  139. * Update .npmignore
  140. 1.0.0-beta.3
  141. =====
  142. * Move `debug` from devDependencies to dependencies
  143. 1.0.0-beta.2
  144. =====
  145. * Relax requirements when using same origin XHR - #80
  146. * Upgrade to JSON3 from JSON2 - #123
  147. * Package library with browserify supporting the UMD pattern - #184
  148. * Move tests to JavaScript
  149. * Add Gulp.js build script
  150. * Fix getOrigin for file:/// urls and standard ports - #173
  151. * Add onerror event handlers to Websockets - #169
  152. * Increase RTO lower bound to prevent spurious timeouts on IE8/9 - #161
  153. * Use window.crypto for random values when available - #128
  154. * Fix handling of listeners added and removed mid-dispatch - #127
  155. * Fix XHR Streaming for IE8 - #83
  156. * Remove explicit AMD name - #107
  157. * Check for an empty response from /info request - #143
  158. * Add Content-Type to XHR requests to fix issue over HTTPS on Galaxy S4 - #164
  159. * Fix iframe fallback when message is sent from a popup in IE7/8 - #166
  160. * Add support for query strings on the url - #72
  161. * Now works inside of Web Workers - #181
  162. * Support EventSource / Server Sent Events outside of iframes - #201
  163. * Rename protocols to transports - #65
  164. * Allow transports which need the body to trigger on 'interactive' readyState - #175
  165. * try/catch access to document.domain - #187
  166. * Use `window.location` instead of `document.location` - #195
  167. * Allow usage from node.js with same API
  168. 0.3.4
  169. =====
  170. * Mentioned njoyce's fork of sockjs-gevent.
  171. * #90 - Don't catch onbeforeunload event - it breaks javascript://
  172. links in IE.
  173. * IE mangles 204 response code for 1223 on ajax, see:
  174. http://bugs.jquery.com/ticket/1450
  175. * Make `new` optional for SockJS constructor (via substack).
  176. * It is impossible to cancel JSONP polling request - compensate for that.
  177. * Refactored EventEmitter prototype (used only internally)
  178. * #66 - Failure to post data to /xhr_send should kill the session
  179. 0.3.2
  180. =====
  181. * #77 - Getting /info on modern browsers when html is served from
  182. file:// urls was broken.
  183. 0.3.1
  184. =====
  185. * #61 - Meteor guys found that we unintentionally catch "onopen" errors.
  186. * #63 - Meteorjs guys found that xhr-streaming on Safari sometimes
  187. left busy cursor running.
  188. * Increased allowed time for websocket transport (from 1 rtt to 2),
  189. this should make ws transport more reliable over SSL, at the cost
  190. of slightly longer connection time for users with blocked ws.
  191. * #57 - previous fix didn't really work, sockjs-client still left
  192. a mess in browsers history when using iframe transports. This
  193. is fixed now.
  194. * #60 - Opera 12 (next) claims to do AJAX2 / CORS, but can't
  195. do xhr-streaming.
  196. * #58 - onunload test sometimes failed on Safari on windows
  197. * Updated readme WRT websocket protocols
  198. * Updated readme WRT deployments on heroku
  199. * Add minimalistic license block to every source file.
  200. 0.3.0
  201. =====
  202. * Temporarily disabled iframe tests - they are failing unpredictably.
  203. * #57 - pointing an iframe to "about:blank" during cleanup caused
  204. Opera to messup history.
  205. * #55 - Improved iframe abstraction (reduced a possible mem leak)
  206. * Refactored AJAX abstractions, for better CORS handing - again.
  207. * Add additional parent origin security check to an iframe.
  208. * Urls with hashes or query strings can't be passed to SockJS.
  209. * #18 - Mention workaround for Firefox ESC key issue
  210. * #53 - AMD compliance
  211. * sockjs/sockjs-protocol#28 - always use square brackets for
  212. websocket frames
  213. * #51 - initial support for IE10 - try XHR before XDR
  214. * #28 - handle onunload / onbeforeunload in a more robust fashion
  215. * #49 - support SockJS-client being used from files served from
  216. file:// urls.
  217. 0.2.1
  218. =====
  219. * "smoke-latency.html" test was unnecesairly sending too much data.
  220. * Bumped core dependencies (coffee-script and uglify-js)
  221. * Minor updates to the README, few cosmetic changes in the code.
  222. 0.2.0
  223. =====
  224. * The API had changed - use `protocols_whitelist` option instead of
  225. passing an array of protocols as a second argument to SockJS constructor.
  226. * Dropped 'chunking-test' functionality and replace it with 'info'.
  227. * Rewritten protocol-choosing alogirthm, see "utils.detectProtocols" method.
  228. * Use dynamic protocol timeouts based on RTT, not hardcoded 5 seconds
  229. * #34 - Don't ever reuse `session_id`, especially when trying
  230. fallback protocols.
  231. * The test server got moved from SockJS-client to SockJS-node.
  232. * Don't test unicode surrogates - it can't work in some environments.
  233. * XHR/XDR helpers were rewritten, ajax transports were simplified.
  234. * Added a domain check in the iframe to improve security.
  235. * SockJS will now trigger 1002 error if there is a problem during handshake
  236. instead of 2000 error.
  237. * Smoke-throughput test is renamed to smoke-latency.
  238. 0.1.2
  239. =====
  240. * #29 - Allow all unicode characters to be send over SockJS.
  241. * #15 - SockJS should now work fine even if the connection is started
  242. in HEAD, before BODY is loaded.
  243. * #28 - In rare circumstances WebSocket connection can be left intact
  244. after the page is unloaded in FireFox.
  245. * Updated scripts to work with Node 0.6.
  246. * Initial work to do better QUnit testing.
  247. * Updated the minifying script (always escape unicode chars, remove
  248. trailing comment).
  249. * Use string instead of array of chars (utils.js:random_number_string).
  250. 0.1.1
  251. =====
  252. * #21 Get JsonP transport working on IE9 (Vladimir Dronnikov).
  253. * #26 Emit heartbeat event.
  254. * #27 Include license inline.
  255. 0.1.0
  256. =====
  257. * SockJS-client can only send UTF-8 encodable strings. Previously we
  258. took advantage of rich data structures and automatically
  259. json-encoded them, but this got removed. Now, all data passed to
  260. `send` will be converted to string. This is also how native
  261. * `status` property on `EventClose` is renamed to `code`
  262. as per Websocket API
  263. WebSockets behave.
  264. * The test server was updated to new `sockjs-node` API
  265. * Fixed problem with Jsonp-polling transport on IE9
  266. * Repository was moved - updated links.
  267. 0.0.4
  268. =====
  269. * All transports were refactored, some transports were introduced:
  270. htmlfile and separate xhr-streaming.
  271. * Added logic to detect support for http chunking, and thus a
  272. possibility to rule out streaming transports before running them.
  273. * Added 'cookie' option, useful for cookie-based load balancing
  274. (currently, it make a difference only for IE).
  275. * Added hack to prevent EventSource from crashing Safari and Chrome.
  276. * Loads and loads of other small and medium changes.
  277. 0.0.2
  278. =====
  279. * Initial support for JSESSIONID based load balancing. Currently
  280. doesn't play nicely with IE XDomainRequest transport.
  281. 0.0.1
  282. =====
  283. * Initial release.