chore(repo): Update dependency socket.io-parser@>=4.0.0 <4.2.6 to v4.2.7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
socket.io-parser@>=4.0.0 <4.2.6 (source)	[4.2.6 → 4.2.7](https://renovatebot.com/diffs/npm/socket.io-parser@>=4.0.0 <4.2.6/4.2.6/4.2.7)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Socket.IO: Zero-attachment Memory Exhaustion

CVE-2026-69185 / GHSA-2m8v-j782-fhvr

More information

Details

Impact

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

Patches

Version range	Used by	Fixed version
>=4.0.0 <4.2.7	socket.io@4.x and socket.io-client@4.x	4.2.7
>=3.4.0 <3.4.5	socket.io@2.x	3.4.5
<3.3.6	socket.io-client@2.x	3.3.6

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr
• https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
• https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
• https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
• https://github.com/advisories/GHSA-2m8v-j782-fhvr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

socketio/socket.io (socket.io-parser@>=4.0.0 <4.2.6)

v4.2.7

Compare Source

Bug Fixes

• honor toJSON() when deconstructing a binary packet (#​5518) (57f1114)
• reject binary packets with zero attachments (7c6ef57)

New Contributors

• @​spokodev made their first contribution in #​5518

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Aug 28, 2026 5:22pm
swingset	Ready	Preview	Aug 28, 2026 5:22pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 13a0c97

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9560

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9560

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9560

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9560

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9560

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9560

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9560

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9560

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9560

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9560

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9560

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9560

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9560

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9560

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9560

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9560

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9560

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9560

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9560

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9560

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9560

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9560

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9560

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9560

commit: 13a0c97