Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency ws to v8.18.0 #134

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependency ws to v8.18.0 #134

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 7, 2021

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
ws 8.3.0 -> 8.18.0 age adoption passing confidence
@types/ws (source) 8.2.1 -> 8.5.13 age adoption passing confidence

Release Notes

websockets/ws (ws)

v8.18.0

Compare Source

Features

v8.17.1

Compare Source

Bug fixes

A request with a number of headers exceeding the[server.maxHeadersCount][server.maxHeadersCount]
threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the
    [--max-http-header-size=size][--max-http-header-size=size] and/or the [maxHeaderSize][maxHeaderSize] options so
    that no more headers than the server.maxHeadersCount limit can be sent.
  2. Set server.maxHeadersCount to 0 so that no limit is applied.

v8.17.0

Compare Source

Features

  • The WebSocket constructor now accepts the createConnection option (#​2219).

Other notable changes

  • The default value of the allowSynchronousEvents option has been changed to
    true (#​2221).

This is a breaking change in a patch release. The assumption is that the option
is not widely used.

v8.16.0

Compare Source

Features

  • Added the autoPong option (01ba54e).

v8.15.1

Compare Source

Notable changes

  • The allowMultipleEventsPerMicrotask option has been renamed to
    allowSynchronousEvents (4ed7fe5).

This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.

v8.15.0

Compare Source

Features

  • Added the allowMultipleEventsPerMicrotask option (93e3552).

v8.14.2

Compare Source

Bug fixes

  • Fixed an issue that allowed errors thrown by failed assertions to be
    swallowed when running tests (7f4e1a7).

v8.14.1

Compare Source

Bug fixes
  • Improved the reliability of two tests for CITGM (fd3c64c).

v8.14.0

Compare Source

Features

  • The WebSocket constructor now accepts HTTP(S) URLs (#​2162).
  • The socket argument of server.handleUpgrade() can now be a generic
    Duplex stream (#​2165).

Other notable changes

  • At most one event per microtask is now emitted (#​2160).

v8.13.0

Compare Source

Features

  • Added the finishRequest option to support late addition of headers (#​2123).

v8.12.1

Compare Source

Bug fixes

  • Added browser condition to package.json (#​2118).

v8.12.0

Compare Source

Features

  • Added support for utf-8-validate@6 (ff63bba).

Other notable changes

  • [buffer.isUtf8()][buffer.isUtf8()] is now used instead of utf-8-validate if available
    (42d79f6).

v8.11.0

Compare Source

Features

  • WebSocket.prototype.addEventListener() now supports an event listener
    specified as an object with a handleEvent() method. (9ab743a).

Bug fixes

  • WebSocket.prototype.addEventListener() now adds an event listener only if it
    is not already in the list of the event listeners for the specified event type
    (1cec17d).

v8.10.0

Compare Source

Features

  • Added an export for package.json (211d5d3).

v8.9.0

Compare Source

Features

  • Added the ability to connect to Windows named pipes (#​2079).

v8.8.1

Compare Source

Bug fixes

  • The Authorization and Cookie headers are no longer sent if the original
    request for the opening handshake is sent to an IPC server and the client is
    redirected to another IPC server (bc8bd34).

v8.8.0

Compare Source

Features

  • Added the WS_NO_BUFFER_UTIL and WS_NO_UTF_8_VALIDATE environment
    variables (becf237).

v8.7.0

Compare Source

Features

  • Added the ability to inspect the invalid handshake requests and respond to
    them with a custom HTTP response. (6e5a5ce).

Bug fixes

  • The handshake is now aborted if the Upgrade header field value in the HTTP
    response is not a case-insensitive match for the value "websocket" (0fdcc0a).
  • The Authorization and Cookie headers are no longer sent when following an
    insecure redirect (wss: to ws:) to the same host (d68ba9e).

v8.6.0

Compare Source

Features

  • Added the ability to remove confidential headers on a per-redirect basis (#​2030).

v8.5.0

Compare Source

Features

  • Added the ability to use a custom WebSocket class on the server (#​2007).

Bug fixes

  • When following redirects, the Authorization and Cookie headers are no
    longer sent if the redirect host is different from the original host (#​2013).

v8.4.2

Compare Source

Bug fixes

  • Fixed a data framing issue introduced in version 8.4.1 (#​2004).

v8.4.1

Compare Source

Notable changes

  • To improve performance, strings sent via websocket.ping(),
    websocket.pong(), and websocket.send() are no longer converted to
    Buffers if the data does not need to be masked (#​2000).

v8.4.0

Compare Source

Features

  • Added ability to generate custom masking keys (#​1990).

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/ws-8.x branch 2 times, most recently from 1d253dd to e6216e1 Compare December 8, 2021 13:47
@renovate renovate bot force-pushed the renovate/ws-8.x branch from e6216e1 to 28e4151 Compare December 20, 2021 20:49
@renovate renovate bot changed the title Update dependency @types/ws to v8.2.2 Update dependency ws to v8.4.0 Dec 20, 2021
@renovate renovate bot force-pushed the renovate/ws-8.x branch 2 times, most recently from e4f1d2a to 9181e5b Compare January 2, 2022 14:30
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 9181e5b to 7a24d50 Compare January 13, 2022 21:09
@renovate renovate bot changed the title Update dependency ws to v8.4.0 Update dependency ws to v8.4.1 Jan 13, 2022
@renovate renovate bot changed the title Update dependency ws to v8.4.1 Update dependency ws to v8.4.2 Jan 14, 2022
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 7a24d50 to 15e06df Compare January 14, 2022 15:59
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 15e06df to a9e8b9a Compare February 7, 2022 21:22
@renovate renovate bot changed the title Update dependency ws to v8.4.2 Update dependency ws to v8.5.0 Feb 7, 2022
@renovate renovate bot force-pushed the renovate/ws-8.x branch 3 times, most recently from cafb25f to 908acd2 Compare February 24, 2022 22:58
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 908acd2 to 530d977 Compare March 2, 2022 00:21
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 530d977 to b1fc3dd Compare March 26, 2022 15:22
@renovate renovate bot changed the title Update dependency ws to v8.5.0 Update dependency ws to v8.6.0 May 15, 2022
@renovate renovate bot force-pushed the renovate/ws-8.x branch from b1fc3dd to 9d9fe3e Compare May 15, 2022 20:11
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 9d9fe3e to 414f652 Compare June 18, 2022 14:34
@renovate renovate bot changed the title Update dependency ws to v8.6.0 Update dependency ws to v8.8.0 Jun 18, 2022
@renovate renovate bot changed the title Update dependency ws to v8.8.0 Update dependency ws to v8.9.0 Sep 25, 2022
@renovate renovate bot force-pushed the renovate/ws-8.x branch from bddea25 to 3fa3854 Compare November 20, 2022 07:28
@renovate renovate bot changed the title Update dependency ws to v8.9.0 Update dependency ws to v8.11.0 Nov 20, 2022
@renovate renovate bot changed the title Update dependency ws to v8.11.0 Update dependency ws to v8.13.0 Mar 23, 2023
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 3fa3854 to 987bb7c Compare March 23, 2023 13:51
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 987bb7c to 3ccfafe Compare June 8, 2023 21:10
@renovate renovate bot changed the title Update dependency ws to v8.13.0 Update dependency ws to v8.14.0 Sep 6, 2023
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 3ccfafe to 786a331 Compare September 6, 2023 16:42
@renovate renovate bot changed the title Update dependency ws to v8.14.0 Update dependency ws to v8.14.1 Sep 8, 2023
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 786a331 to c82973a Compare September 8, 2023 18:36
@renovate renovate bot changed the title Update dependency ws to v8.14.1 Update dependency ws to v8.14.2 Sep 19, 2023
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 022b645 to dae5a1d Compare October 1, 2023 17:55
@renovate renovate bot force-pushed the renovate/ws-8.x branch from dae5a1d to c658611 Compare October 10, 2023 21:37
@renovate renovate bot force-pushed the renovate/ws-8.x branch from c658611 to 4339807 Compare October 18, 2023 22:52
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 4339807 to 7738677 Compare November 7, 2023 23:17
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 7738677 to a061bb2 Compare November 21, 2023 05:19
@renovate renovate bot changed the title Update dependency ws to v8.14.2 Update dependency ws to v8.15.0 Dec 9, 2023
@renovate renovate bot force-pushed the renovate/ws-8.x branch 2 times, most recently from 501e23d to 7c35b83 Compare December 12, 2023 21:22
@renovate renovate bot changed the title Update dependency ws to v8.15.0 Update dependency ws to v8.15.1 Dec 12, 2023
@renovate renovate bot changed the title Update dependency ws to v8.15.1 Update dependency ws to v8.16.0 Dec 26, 2023
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 7c35b83 to 3fe95cd Compare December 26, 2023 16:52
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 3fe95cd to c278300 Compare April 28, 2024 06:14
@renovate renovate bot changed the title Update dependency ws to v8.16.0 Update dependency ws to v8.17.0 Apr 28, 2024
@renovate renovate bot force-pushed the renovate/ws-8.x branch from c278300 to 34b42b0 Compare June 16, 2024 15:40
@renovate renovate bot changed the title Update dependency ws to v8.17.0 Update dependency ws to v8.17.1 Jun 16, 2024
@renovate renovate bot force-pushed the renovate/ws-8.x branch from 34b42b0 to edaa6f3 Compare July 3, 2024 18:30
@renovate renovate bot changed the title Update dependency ws to v8.17.1 Update dependency ws to v8.18.0 Jul 3, 2024
@renovate renovate bot force-pushed the renovate/ws-8.x branch from edaa6f3 to b3f6bca Compare July 13, 2024 04:30
@renovate renovate bot force-pushed the renovate/ws-8.x branch from b3f6bca to e64b36f Compare July 29, 2024 09:29
@renovate renovate bot force-pushed the renovate/ws-8.x branch from e64b36f to 6ca7025 Compare November 2, 2024 10:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants