[Snyk] Upgrade ws from 8.8.1 to 8.18.0 #2
Conversation
Snyk has created this PR to upgrade ws from 8.8.1 to 8.18.0. See this package in npm: ws See this project in Snyk: https://app.snyk.io/org/ramzimalhas/project/ad678fec-ea01-485a-9e31-d565be739bb8?utm_source=github&utm_medium=referral&page=upgrade-pr
|
|
Important Review skippedIgnore keyword(s) in the title. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
|
Changes made by this pull request: src/zombie-lord/package-lock.json src/zombie-lord/package.json |
Snyk has created this PR to upgrade ws from 8.8.1 to 8.18.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 15 versions ahead of your current version.
The recommended version was released on 2 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-WS-7266574
Release notes
Package name: ws
-
8.18.0 - 2024-07-03
- Added support for
-
8.17.1 - 2024-06-16
- Fixed a DoS vulnerability (#2231).
const http = require('http');
- Reduce the maximum allowed length of the request headers using the
- Set
-
8.17.0 - 2024-04-28
- The
- The default value of the
-
8.16.0 - 2023-12-26
- Added the
-
8.15.1 - 2023-12-12
- The
-
8.15.0 - 2023-12-09
- Added the
-
8.14.2 - 2023-09-19
- Fixed an issue that allowed errors thrown by failed assertions to be
-
8.14.1 - 2023-09-08
-
8.14.0 - 2023-09-06
-
8.13.0 - 2023-03-10
-
8.12.1 - 2023-02-13
-
8.12.0 - 2023-01-07
-
8.11.0 - 2022-11-06
-
8.10.0 - 2022-10-24
-
8.9.0 - 2022-09-22
-
8.8.1 - 2022-07-15
from ws GitHub release notesFeatures
Blob(#2229).Bug fixes
A request with a number of headers exceeding the
server.maxHeadersCountthreshold could be used to crash a ws server.
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in #2230.
In vulnerable versions of ws, the issue can be mitigated in the following ways:
--max-http-header-size=sizeand/or themaxHeaderSizeoptions sothat no more headers than the
server.maxHeadersCountlimit can be sent.server.maxHeadersCountto0so that no limit is applied.Features
WebSocketconstructor now accepts thecreateConnectionoption (#2219).Other notable changes
allowSynchronousEventsoption has been changed totrue(#2221).This is a breaking change in a patch release. The assumption is that the option
is not widely used.
Features
autoPongoption (01ba54e).Notable changes
allowMultipleEventsPerMicrotaskoption has been renamed toallowSynchronousEvents(4ed7fe5).This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.
Features
allowMultipleEventsPerMicrotaskoption (93e3552).Bug fixes
swallowed when running tests (7f4e1a7).
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: