In vulnerable versions of ws, the issue can be mitigated in the following ways:
Reduce the maximum allowed length of the request headers using the
[--max-http-header-size=size][] and/or the [maxHeaderSize][] options so
that no more headers than the server.maxHeadersCount limit can be sent.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/la-famiglia-jst2324/parma-web/network/alerts).
Bumps the npm_and_yarn group with 6 updates:
14.0.1
14.1.1
4.3.1
4.4.0
1.8.21
1.8.22
1.15.3
1.15.6
4.15.4
4.15.7
8.14.2
8.17.1
Updates
next
from 14.0.1 to 14.1.1Commits
5f59ee5
v14.1.1f48b90b
even more7f789f4
more timeoutab71c4c
update timeout75f60d9
update trigger release workflow74b3f0f
Server Action tests (#62655)a6946b6
Backport metadata fixes (#62663)4002f4b
Fix draft mode invariant (#62121)7dbf6f8
fix: babel usage with next/image (#61835)3efc842
Fix next/server apit push alias for ESM pkg (#61721)Updates
@adobe/css-tools
from 4.3.1 to 4.4.0Changelog
Sourced from
@adobe/css-tools
's changelog.Commits
Updates
@grpc/grpc-js
from 1.8.21 to 1.8.22Release notes
Sourced from
@grpc/grpc-js
's releases.Commits
a8a0203
Merge pull request from GHSA-7v5v-9h63-cj863b110cd
grpc-js: Bump to 1.8.228e62222
grpc-js: Avoid buffering significantly more than max_receive_message_size per...9d83947
Merge pull request #2742 from sergiitk/backport-1.8-psm-interop-common-prod-t...00f348c
Merge pull request #2729 from sergiitk/psm-interop-common-prod-tests36d105b
Merge pull request #2737 from murgatroid99/backport-1.8-grpc-js_linkify-it_fix969e305
Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fixd78216f
Merge pull request #2715 from sergiitk/backport-1.8-psm-interop-pkg-devf38966a
Merge pull request #2712 from sergiitk/psm-interop-pkg-devffefff2
Merge pull request #2640 from XuanWang-Amos/backport-1.8-psm-interop-shared-b...Updates
follow-redirects
from 1.15.3 to 1.15.6Commits
35a517c
Release version 1.15.6 of the npm package.c4f847f
Drop Proxy-Authorization across hosts.8526b4a
Use GitHub for disclosure.b1677ce
Release version 1.15.5 of the npm package.d8914f7
Preserve fragment in responseUrl.6585820
Release version 1.15.4 of the npm package.7a6567e
Disallow bracketed hostnames.05629af
Prefer native URL instead of deprecated url.parse.1cba8e8
Prefer native URL instead of legacy url.resolve.72bc2a4
Simplify _processResponse error handling.Updates
jose
from 4.15.4 to 4.15.7Release notes
Sourced from jose's releases.
Changelog
Sourced from jose's changelog.
Commits
5084808
chore(release): 4.15.7122c939
chore(release): 4.15.6e36d69e
fix: add a workerd package.json target765aafd
chore(release): 4.15.5b36e45e
test: add export check to x509 pem import testse839ecb
test: stop testing JWE RSA1_5 Algorithm1b91d88
fix: add a maxOutputLength option to zlib inflate9ca2b24
build: remove release actionf3035d8
chore: cleanup after releaseUpdates
ws
from 8.14.2 to 8.17.1Release notes
Sourced from ws's releases.
... (truncated)
Commits
3c56601
[dist] 8.17.1e55e510
[security] Fix crash when the Upgrade header cannot be read (#2231)6a00029
[test] Increase code coverageddfe4a8
[perf] Reduce the amount ofcrypto.randomFillSync()
callsb73b118
[dist] 8.17.029694a5
[test] Use thehighWaterMark
variable934c9d6
[ci] Test on node 221817bac
[ci] Do not test on node 2196c9b3d
[major] Flip the default value ofallowSynchronousEvents
(#2221)e5f32c7
[fix] Emit at most one event per event loop iteration (#2218)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show