socketio / socket.io
Repository health
Security advisories, maintenance activity, dependencies and license for socketio/socket.io, with what was checked and what was not.
Security
75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 6.6/10
Checks sorted from strongest to weakest.
- Maintained30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 1010/10
- Security-Policysecurity policy file detected10/10
- Dangerous-Workflowno dangerous workflow patterns detected10/10
- Licenselicense file detected10/10
- Packagingpackaging workflow detected10/10
- Token-Permissionsdetected GitHub workflow tokens with excessive permissions9/10
- Binary-Artifactsbinaries present in source code9/10
- Code-ReviewFound 6/30 approved changesets -- score normalized to 22/10
- Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 22/10
- CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected0/10
- SASTSAST tool is not run on all commits -- score normalized to 00/10
- Fuzzingproject is not fuzzed0/10
- Signed-Releasesno releases foundnot scored
- Branch-ProtectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 19 of 100 external pull requests merged (30% of those decided), median 18.7 days to merge.From the 100 most recently updated pull requests, bots excluded.
Recent releases
- socket.io@4.8.425 Sept 2026 · same day as previous
- socket.io-client@4.8.425 Sept 2026 · same day as previous
- engine.io-client@6.6.725 Sept 2026 · 1 day after previous
- engine.io@6.6.1124 Sept 2026 · 16 days after previous
- @socket.io/cluster-engine@0.1.18 Sept 2026 · 5 days after previous
- engine.io@6.6.103 Sept 2026 · 49 days after previous
Commit activity
100 commits sampledClick a bar to browse commits — or open GitHub for the full month ↓
Work rhythm
Commits by day of week
Pull request health
How fast do PRs resolve?
Days from open to merged / closed, last 13 PRs.
Pending right now17 open PRs
⚠ 5 stale PRs — open more than 60 days, no update in 30+
Long-running PRs without recent activity are usually maintainer-bandwidth signals — review process bottleneck, orphaned branches, or quietly abandoned work.
Recently merged3 PRs in the recent window
Issue triage — last 12 weeks
Blue bars = issues opened that week, green = closed. Healthy projects keep these roughly in balance — a persistently bigger blue bar means an opening backlog. open issues on GitHub ↗
Release cadence· median 3d between releases
Latest socket.io@4.8.4 shipped 19d ago · typical gap 3d · shipping faster than before · 10 releases sampled.
New faces — last 90 days8 contributors appearing for the first time in this window
Heuristic: contributors whose earliest commit in the recent sample is < 90 days old AND who have ≤ 3 commits in the window. Click a name for their commits in this repo.
Top contributors
Issue health
Computed from GitHub Issues — no estimates. Per-issue rates use the 52 most-recently-updated issues (recent, not all-time); the open total and oldest-open age are repo-wide.
Total open on the repo (authoritative).
From 31 recently-closed issues. p90 4.0y.
Age of the longest-open unresolved issue.
4 of 21 recent open issues have no comments yet.
11 of 21 recent open issues had no update in 30d+.
2 of 21 recent open issues are unlabeled.
What the backlog is about
AI-generatedOpen issues grouped into themes by an LLM from their titles — a summary, not an authoritative classification. Numbers reflect the 21 most-recently-active open issues.
Most-wanted
Open issues with the most positive reactions — what the community is asking for.
Most-discussed
Open issues with the most comments — where the conversation is.
Official documentation can't open
#5511 · opened 4mo ago · @sourav-18
Valkey streams adapter
#5281 · opened 1y ago · @fjeldstad
A client receiving an `Object` with more than 10 binary fields closes the connection
#5504 · opened 4mo ago · @guillaume-mueller
TS: Exported variable X has or is using name Y from external module Z but cannot be named.ts(4023)
#5307 · opened 1y ago · @JK-Effects
Heartbeat timeout is no longer reset on packet
#5450 · opened 8mo ago · @streunerlein
Labels in the recent sample
Per-issue rates are computed from a sample of 52 most-recently-updated issues, so they describe recent behavior rather than the all-time backlog. Reaction and comment counts come straight from GitHub.
Dependencies
Checked packages and import counts
Checked counts describe advisory coverage, not the repository’s complete dependency inventory. External imports come from a separate source-code graph.