chore(deps): update dependency ws to v8 by renovate[bot] · Pull Request #76 · settlemint-archive/hyperledger-explorer

renovate · 2025-01-24T13:14:21Z

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
ws	dependencies	major	`^7.4.6` -> `^8.0.0`
@types/ws (source)	devDependencies	major	`^7.2.6` -> `^8.0.0`

Release Notes

websockets/ws (ws)

`v8.18.0`

Compare Source

Features

Added support for Blob (#2229).

`v8.17.1`

Compare Source

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][server.maxHeadersCount]
threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the
[--max-http-header-size=size][--max-http-header-size=size] and/or the [maxHeaderSize][maxHeaderSize] options so
that no more headers than the server.maxHeadersCount limit can be sent.
Set server.maxHeadersCount to 0 so that no limit is applied.

`v8.17.0`

Compare Source

Features

The WebSocket constructor now accepts the createConnection option (#2219).

Other notable changes

The default value of the allowSynchronousEvents option has been changed to
true (#2221).

This is a breaking change in a patch release. The assumption is that the option
is not widely used.

`v8.16.0`

Compare Source

Features

Added the autoPong option (01ba54e).

`v8.15.1`

Compare Source

Notable changes

The allowMultipleEventsPerMicrotask option has been renamed to
allowSynchronousEvents (4ed7fe5).

This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.

`v8.15.0`

Compare Source

Features

Added the allowMultipleEventsPerMicrotask option (93e3552).

`v8.14.2`

Compare Source

Bug fixes

Fixed an issue that allowed errors thrown by failed assertions to be
swallowed when running tests (7f4e1a7).

`v8.14.1`

Compare Source

Bug fixes

Improved the reliability of two tests for CITGM (fd3c64c).

`v8.14.0`

Compare Source

Features

The WebSocket constructor now accepts HTTP(S) URLs (#2162).
The socket argument of server.handleUpgrade() can now be a generic
Duplex stream (#2165).

Other notable changes

At most one event per microtask is now emitted (#2160).

`v8.13.0`

Compare Source

Features

Added the finishRequest option to support late addition of headers (#2123).

`v8.12.1`

Compare Source

Bug fixes

Added browser condition to package.json (#2118).

`v8.12.0`

Compare Source

Features

Added support for utf-8-validate@6 (ff63bba).

Other notable changes

[buffer.isUtf8()][buffer.isUtf8()] is now used instead of utf-8-validate if available
(42d79f6).

`v8.11.0`

Compare Source

Features

WebSocket.prototype.addEventListener() now supports an event listener
specified as an object with a handleEvent() method. (9ab743a).

Bug fixes

WebSocket.prototype.addEventListener() now adds an event listener only if it
is not already in the list of the event listeners for the specified event type
(1cec17d).

`v8.10.0`

Compare Source

Features

Added an export for package.json (211d5d3).

`v8.9.0`

Compare Source

Features

Added the ability to connect to Windows named pipes (#2079).

`v8.8.1`

Compare Source

Bug fixes

The Authorization and Cookie headers are no longer sent if the original
request for the opening handshake is sent to an IPC server and the client is
redirected to another IPC server (bc8bd34).

`v8.8.0`

Compare Source

Features

Added the WS_NO_BUFFER_UTIL and WS_NO_UTF_8_VALIDATE environment
variables (becf237).

`v8.7.0`

Compare Source

Features

Added the ability to inspect the invalid handshake requests and respond to
them with a custom HTTP response. (6e5a5ce).

Bug fixes

The handshake is now aborted if the Upgrade header field value in the HTTP
response is not a case-insensitive match for the value "websocket" (0fdcc0a).
The Authorization and Cookie headers are no longer sent when following an
insecure redirect (wss: to ws:) to the same host (d68ba9e).

`v8.6.0`

Compare Source

Features

Added the ability to remove confidential headers on a per-redirect basis (#2030).

`v8.5.0`

Compare Source

Features

Added the ability to use a custom WebSocket class on the server (#2007).

Bug fixes

When following redirects, the Authorization and Cookie headers are no
longer sent if the redirect host is different from the original host (#2013).

`v8.4.2`

Compare Source

Bug fixes

Fixed a data framing issue introduced in version 8.4.1 (#2004).

`v8.4.1`

Compare Source

Notable changes

To improve performance, strings sent via websocket.ping(),
websocket.pong(), and websocket.send() are no longer converted to
Buffers if the data does not need to be masked (#2000).

`v8.4.0`

Compare Source

Features

Added ability to generate custom masking keys (#1990).

`v8.3.0`

Compare Source

Features

Added ability to pause and resume a WebSocket (0a8c7a9).

Bug fixes

Fixed a bug that could prevent the connection from being closed cleanly when
using the stream API (ed2b803).
When following redirects, an error is now emitted and not thrown if the
redirect URL is invalid (#1980).

`v8.2.3`

Compare Source

Bug fixes

When context takeover is enabled, messages are now compressed even if their size
is below the value of the perMessageDeflate.threshold option (41ae563).

`v8.2.2`

Compare Source

Bug fixes

Some closing operations are now run only if needed (ec9377c).

`v8.2.1`

Compare Source

Bug fixes

Fixed an issue where the socket was not resumed, preventing the connection
from being closed cleanly (869c989).

`v8.2.0`

Compare Source

Features

Added WebSocket.WebSocket as an alias for WebSocket and
WebSocket.WebSocketServer as an alias for WebSocket.Server to fix name
consistency and improve interoperability with the ES module wrapper (#1935).

`v8.1.0`

Compare Source

Features

Added ability to skip UTF-8 validation (#1928).

Bug fixes

Fixed an issue with a breaking change in Node.js master (6a72da3).
Fixed a misleading error message (c95e695).

`v8.0.0`

Compare Source

Breaking changes

The WebSocket constructor now throws a SyntaxError if any of the
subprotocol names are invalid or duplicated (0aecf0c).
The server now aborts the opening handshake if an invalid
Sec-WebSocket-Protocol header field value is received (1877dde).
The protocols argument of handleProtocols hook is no longer an Array but
a Set (1877dde).
The opening handshake is now aborted if the Sec-WebSocket-Extensions header
field value is empty or it begins or ends with a white space (e814110).
Dropped support for Node.js < 10.0.0 (552b506).
The WebSocket constructor now throws a SyntaxError if the connection URL
contains a fragment identifier or if the URL's protocol is not one of 'ws:',
'wss:', or 'ws+unix:' (ebea038).
Text messages and close reasons are no longer decoded to strings. They are
passed as Buffers to the listeners of their respective events. The listeners
of the 'message' event now take a boolean argument specifying whether or not
the message is binary (e173423).

Existing code can be migrated by decoding the buffer explicitly.
```
websocket.on('message', function message(data, isBinary) {
  const message = isBinary ? data : data.toString();
  // Continue as before.
});

websocket.on('close', function close(code, data) {
  const reason = data.toString();
  // Continue as before.
});
```
The package now uses an ES module wrapper (78adf5f).
WebSocketServer.prototype.close() no longer closes existing connections
(df7de57).

Existing code can be migrated by closing the connections manually.
```
websocketServer.close();
for (const ws of websocketServer.clients) {
  ws.terminate();
}
```
The callback of WebSocketServer.prototype.close() is now called with an
error if the server is already closed (abde9cf).
WebSocket.prototype.addEventListener() is now a noop if the type argument
is not one of 'close', 'error', 'message', or 'open' (9558ed1).
WebSocket.prototype.removeEventListener() now only removes listeners added
with WebSocket.prototype.addEventListener() and only one at time (ea95d9c).
The value of the onclose, onerror, onmessage, and onopen properties is
now null if the respective event handler is not set (6756cf5).
The OpenEvent class has been removed (21e6500).

Bug fixes

The event listeners added via handler properties are now independent from the
event listeners added with WebSocket.prototype.addEventListener()
(0b21c03).

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sourcery-ai · 2025-01-24T13:14:28Z

Reviewer's Guide by Sourcery

This pull request updates the @types/ws dependency from version 7.2.6 to version 8.0.0.

Class diagram showing dependency version update

classDiagram
    class Dependencies {
        -@types/ws: string
    }
    note for Dependencies "Version updated from ^7.2.6 to ^8.0.0"

File-Level Changes

Change	Details	Files
Updated the @types/ws dependency to the latest major version.	Updated @types/ws from ^7.2.6 to ^8.0.0 in package.json. Updated @types/ws in package-lock.json.	`package.json` `package-lock.json`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!
Generate a plan of action for an issue: Comment @sourcery-ai plan on
an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, renovate[bot]!). We assume it knows what it's doing!

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

sourcery-ai Bot reviewed Jan 24, 2025

View reviewed changes

chore(deps): update dependency ws to v8

764b32c

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/ws-8.x branch from 0b19028 to 764b32c Compare January 24, 2025 14:10

renovate Bot changed the title ~~chore(deps): update dependency @types/ws to v8~~ chore(deps): update dependency ws to v8 Jan 24, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency ws to v8#76

chore(deps): update dependency ws to v8#76
renovate[bot] wants to merge 1 commit intomainfrom
renovate/ws-8.x

renovate Bot commented Jan 24, 2025 •

edited

Loading

Uh oh!

sourcery-ai Bot commented Jan 24, 2025 •

edited

Loading

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jan 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Bug fixes

Features

Other notable changes

Features

Notable changes

Features

Bug fixes

Bug fixes

Features

Other notable changes

Features

Bug fixes

Features

Other notable changes

Features

Bug fixes

Features

Features

Bug fixes

Features

Features

Bug fixes

Features

Features

Bug fixes

Bug fixes

Notable changes

Features

Features

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Features

Bug fixes

Breaking changes

Bug fixes

Configuration

Uh oh!

sourcery-ai Bot commented Jan 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide by Sourcery

Class diagram showing dependency version update

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jan 24, 2025 •

edited

Loading

sourcery-ai Bot commented Jan 24, 2025 •

edited

Loading