shopathome
shopathome copied to clipboard
Bump ws, engine.io and socket.io-adapter in /angular-app
Bumps ws, engine.io and socket.io-adapter. These dependencies needed to be updated together.
Updates ws
from 8.17.0 to 8.17.1
Release notes
Sourced from ws's releases.
8.17.1
Bug fixes
- Fixed a DoS vulnerability (#2231).
A request with a number of headers exceeding the[
server.maxHeadersCount
][] threshold could be used to crash a ws server.const http = require('http'); const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () { const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split(''); const headers = {}; let count = 0;
for (let i = 0; i < chars.length; i++) { if (count === 2000) break;
for (let j = 0; j < chars.length; j++) { const key = chars[i] + chars[j]; headers[key] = 'x';
if (++count === 2000) break; }
}
headers.Connection = 'Upgrade'; headers.Upgrade = 'websocket'; headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ=='; headers['Sec-WebSocket-Version'] = '13';
const request = http.request({ headers: headers, host: '127.0.0.1', port: wss.address().port });
request.end(); });
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.
In vulnerable versions of ws, the issue can be mitigated in the following ways:
- Reduce the maximum allowed length of the request headers using the [
--max-http-header-size=size
][] and/or the [maxHeaderSize
][] options so that no more headers than theserver.maxHeadersCount
limit can be sent.
... (truncated)
Commits
Updates engine.io
from 6.5.4 to 6.5.5
Release notes
Sourced from engine.io's releases.
6.5.5
This release contains a bump of the
ws
dependency, which includes an important security fix.Advisory: https://github.com/advisories/GHSA-3h5v-q93c-6h6q
Bug Fixes
Links
- Diff: https://github.com/socketio/engine.io/compare/6.5.4...6.5.5
- Client release: -
ws@~8.17.1
(diff)
Changelog
Sourced from engine.io's changelog.
6.5.5 (2024-06-18)
This release contains a bump of the
ws
dependency, which includes an important security fix.Advisory: https://github.com/advisories/GHSA-3h5v-q93c-6h6q
Bug Fixes
Dependencies
3.6.2 (2024-06-18)
This release contains a bump of the
ws
dependency, which includes an important security fix.Advisory: https://github.com/advisories/GHSA-3h5v-q93c-6h6q
Dependencies
Commits
Updates socket.io-adapter
from 2.5.2 to 2.5.5
Release notes
Sourced from socket.io-adapter's releases.
2.5.4
Bug Fixes
- ensure the order of the commands (a13f35f)
- types: ensure compatibility with TypeScript < 4.5 (ca397f3)
Links
2.5.3
Two abstract classes were imported from the Redis adapter repository:
- the
ClusterAdapter
class, which manages the messages sent between the server instances of the cluster- the
ClusterAdapterWithHeartbeat
class, which extends theClusterAdapter
and adds a heartbeat mechanism in order to check the healthiness of the other instancesOther adapters can then just extend those classes and only have to implement the pub/sub mechanism (and not the internal chit-chat protocol):
class MyAdapter extends ClusterAdapterWithHeartbeat { constructor(nsp, pubSub, opts) { super(nsp, opts); this.pubSub = pubSub; pubSub.subscribe("main-channel", (message) => this.onMessage(message)); pubSub.subscribe("specific-channel#" + this.uid, (response) => this.onResponse(response)); }
doPublish(message) {
return this.pubSub.publish("main-channel", message);
}doPublishResponse(requesterUid, response) {
return this.pubSub.publish("specific-channel#" + requesterUid, response);
}
}
Besides, the number of "timeout reached: only x responses received out of y" errors (which can happen when a server instance leaves the cluster) should be greatly reduced by this commit.
Bug Fixes
- cluster: fix count in fetchSockets() method (80af4e9)
- cluster: notify the other nodes when closing (0e23ff0)
Performance Improvements
- cluster: use timer.refresh() (d99a71b)
... (truncated)
Changelog
Sourced from socket.io-adapter's changelog.
2.5.5 (2024-06-18)
This release contains a bump of the
ws
dependency, which includes an important security fix.Advisory: https://github.com/advisories/GHSA-3h5v-q93c-6h6q
2.5.4 (2024-02-22)
Bug Fixes
- ensure the order of the commands (a13f35f)
- types: ensure compatibility with TypeScript < 4.5 (ca397f3)
2.5.3 (2024-02-21)
Two abstract classes were imported from the Redis adapter repository:
- the
ClusterAdapter
class, which manages the messages sent between the server instances of the cluster- the
ClusterAdapterWithHeartbeat
class, which extends theClusterAdapter
and adds a heartbeat mechanism in order to check the healthiness of the other instancesOther adapters can then just extend those classes and only have to implement the pub/sub mechanism (and not the internal chit-chat protocol):
class MyAdapter extends ClusterAdapterWithHeartbeat { constructor(nsp, pubSub, opts) { super(nsp, opts); this.pubSub = pubSub; pubSub.subscribe("main-channel", (message) => this.onMessage(message)); pubSub.subscribe("specific-channel#" + this.uid, (response) => this.onResponse(response)); }
doPublish(message) {
return this.pubSub.publish("main-channel", message);
}doPublishResponse(requesterUid, response) {
return this.pubSub.publish("specific-channel#" + requesterUid, response);
}
}
Besides, the number of "timeout reached: only x responses received out of y" errors (which can happen when a server instance leaves the cluster) should be greatly reduced by this commit.
Bug Fixes
... (truncated)
Commits
05a190a
chore(release): 6.5.593fe190
chore(deps): bump ws from 8.11.0 to 8.17.1 (#93)5eae5a0
chore(release): 2.5.4005d546
ci: test with older TypeScript versiona13f35f
fix: ensure the order of the commands207c0db
refactor: break circular dependency (2)abc93a9
refactor: break circular dependency (1)9d4c4a7
refactor(cluster): export ClusterAdapterOptions and MessageType typesca397f3
fix(types): ensure compatibility with TypeScript < 4.5549156c
chore(release): 2.5.3- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot show <dependency name> ignore conditions
will show all of the ignore conditions of the specified dependency -
@dependabot ignore this major version
will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this minor version
will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this dependency
will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.