v3.0.3: cap socket.io reconnects + monitor cleanup on terminal failure

Defense-in-depth on top of v3.0.2's websocket-only fix. Three changes:

@pryv/socket.io
- io() now passes reconnectionAttempts: 10, reconnectionDelayMax: 60000,
  randomizationFactor: 0.5. socket.io-client defaults are infinite
  attempts at <=5s — one stuck client could drive ~17k req/day per tab.
  With these settings the client gives up after ~10 attempts spread over
  ~1 minute.
- New 'reconnect_failed' listener tears down the underlying _io and
  emits 'error' so consumers can clean up instead of leaving a zombie
  socket reference.

@pryv/monitor
- UpdateMethod/Socket.js error handler now drops this.socket if the
  underlying _io has been torn down. A future Changes.READY will
  rebuild from scratch instead of short-circuiting on the dead handle.

Plus npm audit fix (non-breaking) — 15 → 5 vulnerabilities (the
remaining 5 need --force / major version bumps in dev deps; out of
scope for this PR).

Author: perki

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 <!-- Format based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) -->
 
+## [3.0.3](https://github.com/pryv/lib-js/compare/3.0.2...3.0.3)
+- `@pryv/socket.io`: cap reconnection (`reconnectionAttempts: 10`, `reconnectionDelayMax: 60000`, `randomizationFactor: 0.5`) so a server-side outage no longer drives an unbounded reconnect loop. Listens for `reconnect_failed` and surfaces a terminal `error` event so consumers can clean up instead of leaving a zombie socket reference.
+- `@pryv/monitor`: when the underlying socket.io transport dies (terminal `reconnect_failed`), drop the cached socket reference so a future `Changes.READY` cycle rebuilds from scratch instead of short-circuiting on the dead handle.
+
 ## [3.0.2](https://github.com/pryv/lib-js/compare/3.0.0...3.0.2)
 - Socket.IO: use WebSocket transport directly instead of polling-first. Fixes connection failures against service-core v2 cluster mode (which disables HTTP long-polling).
 

components/pryv-monitor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pryv/monitor",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "Extends `pryv` with event-driven notifications for changes on a Pryv.io account",
   "keywords": [
     "Pryv",

components/pryv-monitor/src/UpdateMethod/Socket.js

@@ -23,7 +23,16 @@ class Socket extends UpdateMethod {
     this.socket = await this.monitor.connection.socket.open();
     this.socket.on('eventsChanged', () => { this.monitor.updateEvents(); });
     this.socket.on('streamsChanged', () => { this.monitor.updateStreams(); });
-    this.socket.on('error', (error) => { this.monitor.emit(Changes.ERROR, error); });
+    this.socket.on('error', (error) => {
+      this.monitor.emit(Changes.ERROR, error);
+      // If the underlying socket.io-client transport has been torn down
+      // (i.e. SocketIO emitted 'error' after reconnect_failed), drop our
+      // reference so a future Changes.READY can rebuild instead of
+      // short-circuiting on the cached, dead handle.
+      if (this.socket && !this.socket._io) {
+        this.socket = null;
+      }
+    });
   }
 
   async stop () {

components/pryv-socket.io/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pryv/socket.io",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "Extends `pryv` with Socket.IO transport",
   "keywords": [
     "Pryv",

components/pryv-socket.io/src/SocketIO.js

@@ -40,8 +40,29 @@ class SocketIO extends EventEmitter {
       this.connection.username()
         .then(username => {
           const socketEndpoint = this.connection.endpoint + username + '?auth=' + this.connection.token;
+          // Cap reconnects so a server-side outage can't drive a runaway loop.
+          // socket.io-client default is reconnectionAttempts: Infinity, max delay 5s.
+          // With these settings, a stuck client gives up after ~10 attempts spread
+          // over ~1 minute (with randomization), then surfaces 'error' to consumers.
           // @ts-ignore - io is callable in socket.io-client
-          this._io = io(socketEndpoint, { forceNew: true, transports: ['websocket'] });
+          this._io = io(socketEndpoint, {
+            forceNew: true,
+            transports: ['websocket'],
+            reconnectionAttempts: 10,
+            reconnectionDelayMax: 60000,
+            randomizationFactor: 0.5
+          });
+
+          // Terminal failure: socket.io-client gave up reconnecting.
+          // Tear down our handle and surface 'error' so consumers (e.g. Monitor)
+          // can clean up instead of leaving a zombie socket reference.
+          this._io.on('reconnect_failed', () => {
+            const dead = this._io;
+            this._io = null;
+            this.connecting = false;
+            try { if (dead) dead.close(); } catch (ex) { }
+            this.emit('error', new Error('socket.io: reconnect_failed (gave up after configured attempts)'));
+          });
 
           // handle failure
           for (const errcode of ['connect_error', 'connection_failed', 'error', 'connection_timeout']) {

components/pryv/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pryv",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "Pryv JavaScript library",
   "keywords": [
     "Pryv",