[Snyk] Upgrade ws from 8.2.3 to 8.19.0#758
Open
X-oss-byte wants to merge 1 commit into
Open
Conversation
Snyk has created this PR to upgrade ws from 8.2.3 to 8.19.0. See this package in npm: ws See this project in Snyk: https://app.snyk.io/org/sammytezzy/project/7f124e9f-9e7a-4ecd-92b5-9c3fc12e6308?utm_source=github&utm_medium=referral&page=upgrade-pr
|
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade ws from 8.2.3 to 8.19.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 28 versions ahead of your current version.
The recommended version was released 23 days ago.
Issues fixed by the recommended upgrade:
SNYK-JS-BASEX-10118294
SNYK-JS-BRACEEXPANSION-9789073
SNYK-JS-CIPHERBASE-12084814
SNYK-JS-ELLIPTIC-7577916
SNYK-JS-ELLIPTIC-7577917
SNYK-JS-ELLIPTIC-7577918
SNYK-JS-ELLIPTIC-8172694
SNYK-JS-ELLIPTIC-8187303
SNYK-JS-ELLIPTIC-8720086
SNYK-JS-INFLIGHT-6095116
SNYK-JS-MINIMATCH-3050818
SNYK-JS-PBKDF2-10495496
SNYK-JS-PBKDF2-10495498
SNYK-JS-SHAJS-12089400
SNYK-JS-WS-7266574
SNYK-JS-WS-7266574
SNYK-JS-TMP-11501554
Release notes
Package name: ws
-
8.19.0 - 2026-01-05
- Added the
- Handled a forthcoming breaking change in Node.js core (1998485).
-
8.18.3 - 2025-06-28
- Fixed a spec violation where the
-
8.18.2 - 2025-05-03
- Fixed an issue that, during message decompression when the maximum size was
-
8.18.1 - 2025-02-21
- The length of the UNIX domain socket paths in the tests has been shortened to
-
8.18.0 - 2024-07-03
- Added support for
-
8.17.1 - 2024-06-16
- Fixed a DoS vulnerability (#2231).
const http = require('http');
- Reduce the maximum allowed length of the request headers using the
- Set
-
8.17.0 - 2024-04-28
- The
- The default value of the
-
8.16.0 - 2023-12-26
-
8.15.1 - 2023-12-12
-
8.15.0 - 2023-12-09
-
8.14.2 - 2023-09-19
-
8.14.1 - 2023-09-08
-
8.14.0 - 2023-09-06
-
8.13.0 - 2023-03-10
-
8.12.1 - 2023-02-13
-
8.12.0 - 2023-01-07
-
8.11.0 - 2022-11-06
-
8.10.0 - 2022-10-24
-
8.9.0 - 2022-09-22
-
8.8.1 - 2022-07-15
-
8.8.0 - 2022-06-09
-
8.7.0 - 2022-05-26
-
8.6.0 - 2022-05-01
-
8.5.0 - 2022-02-07
-
8.4.2 - 2022-01-14
-
8.4.1 - 2022-01-13
-
8.4.0 - 2021-12-20
-
8.3.0 - 2021-11-23
-
8.2.3 - 2021-10-02
from ws GitHub release notesFeatures
closeTimeoutoption (#2308).Bug fixes
Bug fixes
Sec-WebSocket-Versionheader was not addedto the HTTP response if the client requested version was either invalid or
unacceptable (#2291).
Bug fixes
exceeded, led to the emission of an inaccurate error and closure of the
connection with an improper close code (#2285).
Bug fixes
make them work when run via CITGM (021f7b8).
Features
Blob(#2229).Bug fixes
A request with a number of headers exceeding the
server.maxHeadersCountthreshold could be used to crash a ws server.
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in #2230.
In vulnerable versions of ws, the issue can be mitigated in the following ways:
--max-http-header-size=sizeand/or themaxHeaderSizeoptions sothat no more headers than the
server.maxHeadersCountlimit can be sent.server.maxHeadersCountto0so that no limit is applied.Features
WebSocketconstructor now accepts thecreateConnectionoption (#2219).Other notable changes
allowSynchronousEventsoption has been changed totrue(#2221).This is a breaking change in a patch release. The assumption is that the option
is not widely used.
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: