Drop deprecated socket.io dependency

[jankeromnes]

Hello!

ScoutCamp's socket.io has been marked as deprecated for a while, and a security bot recently detected 16 vulnerabilities in the version we import (but don't use) in Janitor.

Maybe this is a good time to remove socket.io from ScoutCamp's dependencies entirely? Does any ScoutCamp-based project still use socket.io, e.g. https://github.com/garden/tree ? (It doesn't seem so).

[jankeromnes]

Another way around this is to upgrade to the newer socket.io 2.0.0 version that was recently published. See jankeromnes#3

[espadrine]

IIRC, socket.io v2 is the reason socket.io became deprecated, as it lacked the features necessary to have the same API we currently offer for it.

[paulmelnikow]

Hey @espadrine, would you be willing to drop the vulnerable dependencies from package.json? If people are using the socketio support they could install them manually.

Dropping them from package.json would allow npm audit to give Shields a clean bill of health.

[espadrine]

@paulmelnikow Is that related to galkn/parsejson#4?

I can remove socket.io for security reasons.

Can you pinpoint what the target is? When I run npm audit in camp, I see 0 vulnerabilities. (When I run it in gh-badges, I see two camp high vulnerabilities, but I don't see why we wouldn't see it in camp.)

…

OK, I figured it out. The latest commit is not part of an npm version. Pushing one now…

[espadrine]

v17.2.2 published.

[paulmelnikow]

Thanks so much!