fix(deps): update dependency ws to v8

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ws	^7.4.5 -> ^8.0.0

---

Release Notes

websockets/ws

v8.8.1

Compare Source

Bug fixes

• The Authorization and Cookie headers are no longer sent if the original request for the opening handshake is sent to an IPC server and the client is redirected to another IPC server (bc8bd34).

v8.8.0

Compare Source

Features

• Added the WS_NO_BUFFER_UTIL and WS_NO_UTF_8_VALIDATE environment variables (becf237).

v8.7.0

Compare Source

Features

• Added the ability to inspect the invalid handshake requests and respond to them with a custom HTTP response. (6e5a5ce).

Bug fixes

• The handshake is now aborted if the Upgrade header field value in the HTTP response is not a case-insensitive match for the value "websocket" (0fdcc0a).
• The Authorization and Cookie headers are no longer sent when following an insecure redirect (wss: to ws:) to the same host (d68ba9e).

v8.6.0

Compare Source

Features

• Added the ability to remove confidential headers on a per-redirect basis (#​2030).

v8.5.0

Compare Source

Features

• Added the ability to use a custom WebSocket class on the server (#​2007).

Bug fixes

• When following redirects, the Authorization and Cookie headers are no longer sent if the redirect host is different from the original host (#​2013).

v8.4.2

Compare Source

Bug fixes

• Fixed a data framing issue introduced in version 8.4.1 (#​2004).

v8.4.1

Compare Source

Notable changes

• To improve performance, strings sent via websocket.ping(), websocket.pong(), and websocket.send() are no longer converted to Buffers if the data does not need to be masked (#​2000).

v8.4.0

Compare Source

Features

• Added ability to generate custom masking keys (#​1990).

v8.3.0

Compare Source

Features

• Added ability to pause and resume a WebSocket (0a8c7a9).

Bug fixes

• Fixed a bug that could prevent the connection from being closed cleanly when using the stream API (ed2b803).
• When following redirects, an error is now emitted and not thrown if the redirect URL is invalid (#​1980).

v8.2.3

Compare Source

Bug fixes

• When context takeover is enabled, messages are now compressed even if their size is below the value of the perMessageDeflate.threshold option (41ae563).

v8.2.2

Compare Source

Bug fixes

• Some closing operations are now run only if needed (ec9377c).

v8.2.1

Compare Source

Bug fixes

• Fixed an issue where the socket was not resumed, preventing the connection from being closed cleanly (869c989).

v8.2.0

Compare Source

Features

• Added WebSocket.WebSocket as an alias for WebSocket and WebSocket.WebSocketServer as an alias for WebSocket.Server to fix name consistency and improve interoperability with the ES module wrapper (#​1935).

v8.1.0

Compare Source

Features

• Added ability to skip UTF-8 validation (#​1928).

Bug fixes

• Fixed an issue with a breaking change in Node.js master (6a72da3).
• Fixed a misleading error message (c95e695).

v8.0.0

Compare Source

Breaking changes

• The WebSocket constructor now throws a SyntaxError if any of the subprotocol names are invalid or duplicated (0aecf0c).

• The server now aborts the opening handshake if an invalid Sec-WebSocket-Protocol header field value is received (1877dde).

• The protocols argument of handleProtocols hook is no longer an Array but a Set (1877dde).

• The opening handshake is now aborted if the Sec-WebSocket-Extensions header field value is empty or it begins or ends with a white space (e814110).

• Dropped support for Node.js < 10.0.0 (552b506).

• The WebSocket constructor now throws a SyntaxError if the connection URL contains a fragment identifier or if the URL's protocol is not one of 'ws:', 'wss:', or 'ws+unix:' (ebea038).

• Text messages and close reasons are no longer decoded to strings. They are passed as Buffers to the listeners of their respective events. The listeners of the 'message' event now take a boolean argument specifying whether or not the message is binary (e173423).

  Existing code can be migrated by decoding the buffer explicitly.

  websocket.on('message', function message(data, isBinary) {
    const message = isBinary ? data : data.toString();
    // Continue as before.
  });
  
  websocket.on('close', function close(code, data) {
    const reason = data.toString();
    // Continue as before.
  });
  

• The package now uses an ES module wrapper (78adf5f).

• WebSocketServer.prototype.close() no longer closes existing connections (df7de57).

  Existing code can be migrated by closing the connections manually.

  websocketServer.close();
  for (const ws of websocketServer.clients) {
    ws.terminate();
  }
  

• The callback of WebSocketServer.prototype.close() is now called with an error if the server is already closed (abde9cf).

• WebSocket.prototype.addEventListener() is now a noop if the type argument is not one of 'close', 'error', 'message', or 'open' (9558ed1).

• WebSocket.prototype.removeEventListener() now only removes listeners added with WebSocket.prototype.addEventListener() and only one at time (ea95d9c).

• The value of the onclose, onerror, onmessage, and onopen properties is now null if the respective event handler is not set (6756cf5).

• The OpenEvent class has been removed (21e6500).

Bug fixes

• The event listeners added via handler properties are now independent from the event listeners added with WebSocket.prototype.addEventListener() (0b21c03).

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.

[DiegoRBaquero]

Why not bump to the latest non-breaking version ^7.5.3 and include all of the newer bugfixes as well?

Given that we have no lock file, latest in range would be installed

[github-actions[bot]]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[renovate[bot]]

Renovate Ignore Notification

As this PR has been closed unmerged, Renovate will ignore this upgrade and you will not receive PRs for any future 8.x releases. However, if you upgrade to 8.x manually then Renovate will reenable minor and patch updates automatically.

If this PR was closed by mistake or you changed your mind, you can simply rename this PR and you will soon get a fresh replacement PR opened.