• cleanup pending acks on timeout to prevent memory leak (37aad11)
• prevent uWebSockets.js from serving missing client files (dfb5ab3)
• reject stateful regexps for dynamic namespaces (59f4f24)
• types: allow emitWithAck() for events with void callbacks (#5453) (8b93a18)
• types: properly import http module (74599a6)

• engine.io@~6.6.0 (no change)
• ws@~8.21.0 (diff)

• types: export ExtendedError for connect_error event (#5548) (c0d5450)
• types: export reserved event interfaces (#5533) (03945df)

• engine.io-client@~6.6.1 (no change)
• ws@~8.21.0 (diff)

• types: export reserved event interfaces (#5533) (ced7dfd)
• restore default transport resolution (3df3fed)

• ws@~8.21.0 (no change)

• refresh ping timeout on incoming packets (da008a5)

• ws@~8.21.0 (no change)

• guard client lookups against prototype pollution (830e364)
• properly export options (37f8a32)
• properly handle upgrade failures (7a33d9b)
• skip side effects when lock acquisition fails (1d4269c)

Diff: https://github.com/socketio/socket.io/compare/@socket.io/cluster-engine@0.1.0...@socket.io/cluster-engine@0.1.1

• reject protocol mismatch for existing sessions (86db1fc)
• restore compatibility with Node.js 10 (ae7fb46)
• run the polling write callback when the client aborts a compressed response (#5540) (915a3ed)

• optimize polling request body buffering (dcbd961)
• stream compressed polling responses (91dd763)

• ws@~8.21.0 (no change)

• reject binary packets with zero attachments (9c6323e)

• reject binary packets with zero attachments (ced94ff)

• honor toJSON() when deconstructing a binary packet (#5518) (57f1114)
• reject binary packets with zero attachments (7c6ef57)

• @spokodev made their first contribution in https://github.com/socketio/socket.io/pull/5518

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.