bare websockets

[benedikt-bartscher]

saves ~11.6 KB gz / ~41 KB raw frontend size (a small js chunk replaces whole socketio)
dropped python deps: wsproto, simple-websocket, python-socketio, python-engineio, bidict
new benchmarks in test_event_transport.py show about 2x performance increase compared to socketio

also migrates AppHarness to granian for consistency. otherwise downstream tests using AppHarness still need uvicorn and wsproto/websockets

[codspeed-hq]

Merging this PR will degrade performance by 4.63%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 1 regressed benchmark
✅ 26 untouched benchmarks
🆕 4 new benchmarks
⏩ 8 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Simulation	test_collect_imports[_complicated_page]	1.6 ms	1.6 ms	-4.63%
🆕	Simulation	test_transport_inbound_socketio	N/A	8 ms	N/A
🆕	Simulation	test_transport_inbound_websocket	N/A	4.3 ms	N/A
🆕	Simulation	test_transport_outbound_socketio	N/A	17.3 ms	N/A
🆕	Simulation	test_transport_outbound_websocket	N/A	8.7 ms	N/A

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing benedikt-bartscher:make-sio-optional (8d667f3) with main (126ef6d)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Greptile Summary

The PR replaces the default Socket.IO transport with a lightweight plain-WebSocket protocol while retaining Socket.IO as an optional transport.

• Adds matching browser and backend WebSocket implementations with handshaking, heartbeat handling, message limits, and validation.
• Makes Socket.IO and Uvicorn dependencies optional and migrates AppHarness to Granian.
• Updates event processing, transport configuration, tests, benchmarks, and release notes.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
reflex/event_namespace.py	Implements the backend plain-WebSocket protocol and now closes malformed or undeserializable client frames instead of preserving log-flooding connections.
packages/reflex-base/src/reflex_base/.templates/web/utils/helpers/websocket.js	Implements the browser WebSocket transport, including documented timeout calculations, handshake processing, heartbeat monitoring, and reconnect-compatible behavior.
packages/reflex-base/src/reflex_base/.templates/web/utils/state.js	Selects the plain-WebSocket or optional Socket.IO client transport and coordinates connection lifecycle cleanup.
reflex/app.py	Integrates the selected event namespace and transport into application assembly.
reflex/utils/exec.py	Updates backend startup and optional server dependency handling for WebSocket support.
reflex/testing.py	Migrates the application test harness backend server to Granian.
tests/units/test_event_namespace.py	Covers handshaking, malformed-frame closure, payload validation, and byte-size enforcement for the new transport.

_{Reviews (20): Last reviewed commit: "Merge remote-tracking branch 'upstream/m..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 19 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 17 files

<sub>Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[abulvenz]

I really like this lightweight approach 👍 .
One thing that is dropped, correct me if I see this wrong: under the hood socketio supports HTTP long-polling in case a websocket connection cannot be established (e.g. due to badly configured load balancers, reverse proxies or simply disabled client support). In most cases that should be fixed anyways on server side for performance reasons.

[benedikt-bartscher]

I really like this lightweight approach 👍 . One thing that is dropped, correct me if I see this wrong: under the hood socketio supports HTTP long-polling in case a websocket connection cannot be established (e.g. due to badly configured load balancers, reverse proxies or simply disabled client support). In most cases that should be fixed anyways on server side for performance reasons.

Thanks 🙏

Yes, the new bare websockets implementation does not support http long-polling yet. However one could still choose the old socketio based transport to archive this. Also iirc longpolling was disabled by default anyway, i guess not a lot of users use it. If this is really needed i could add support to our bare websockets implementation as well.