[Snyk] Upgrade: ms, debug, glob, https-proxy-agent, socks-proxy-agent, stack-utils, ws #3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade:
- ms from 2.1.2 to 2.1.3.
See this package in npm: https://www.npmjs.com/package/ms
- debug from 4.3.4 to 4.3.6.
See this package in npm: https://www.npmjs.com/package/debug
- glob from 7.2.0 to 7.2.3.
See this package in npm: https://www.npmjs.com/package/glob
- https-proxy-agent from 5.0.0 to 5.0.1.
See this package in npm: https://www.npmjs.com/package/https-proxy-agent
- socks-proxy-agent from 6.1.1 to 6.2.1.
See this package in npm: https://www.npmjs.com/package/socks-proxy-agent
- stack-utils from 2.0.5 to 2.0.6.
See this package in npm: https://www.npmjs.com/package/stack-utils
- ws from 8.4.2 to 8.18.0.
See this package in npm: https://www.npmjs.com/package/ws
See this project in Snyk:
https://app.snyk.io/org/organich/project/6d2eaff3-7ec2-4770-8f59-4e962245bce9?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade multiple dependencies.
👯♂ The following dependencies are linked and will therefore be updated together.ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
ms
from 2.1.2 to 2.1.3 | 1 version ahead of your current version | 4 years ago
on 2020-12-08
debug
from 4.3.4 to 4.3.6 | 2 versions ahead of your current version | 2 months ago
on 2024-07-27
glob
from 7.2.0 to 7.2.3 | 2 versions ahead of your current version | 2 years ago
on 2022-05-15
https-proxy-agent
from 5.0.0 to 5.0.1 | 1 version ahead of your current version | 2 years ago
on 2022-04-14
socks-proxy-agent
from 6.1.1 to 6.2.1 | 4 versions ahead of your current version | 2 years ago
on 2022-05-31
stack-utils
from 2.0.5 to 2.0.6 | 1 version ahead of your current version | 2 years ago
on 2022-11-08
ws
from 8.4.2 to 8.18.0 | 20 versions ahead of your current version | 2 months ago
on 2024-07-03
Issues fixed by the recommended upgrade:
SNYK-JS-WS-7266574
Release notes
Package name: ms
-
2.1.3 - 2020-12-08
- Rename zeit to vercel: #151
- Bump eslint from 4.12.1 to 4.18.2: #122
- Add prettier as a dev dependency: #135 #153
- Use GitHub Actions CI: #154
-
2.1.2 - 2019-06-06
- Fixed negative decimals less than -10 don't work: #111
- Support error in case of Infinity: #116
- Update regexp for
- Update chat badge: #119
from ms GitHub release notesPatches
Credits
Huge thanks to @ getsnoopy for helping!
Patches
10-.5is invalid input: #117Credits
Huge thanks to @ yuler and @ 7ma7X for helping!
Package name: debug
-
4.3.6 - 2024-07-27
- Avoid using deprecated RegExp.$1 by @ bluwy in #969
- @ bluwy made their first contribution in #969
-
4.3.5 - 2024-05-31
- cac39b1 Fix/debug depth (#926)
-
4.3.4 - 2022-03-17
- Add section about configuring JS console to show debug messages by @ gitname in #866
- Replace deprecated String.prototype.substr() by @ CommanderRoot in #876
- @ gitname made their first contribution in #866
- @ CommanderRoot made their first contribution in #876
from debug GitHub release notesWhat's Changed
New Contributors
Full Changelog: 4.3.5...4.3.6
Patch
Thank you @ calvintwr for the fix.
What's Changed
New Contributors
Full Changelog: 4.3.3...4.3.4
Package name: glob
-
7.2.3 - 2022-05-15
-
7.2.2 - 2022-05-13
-
7.2.0 - 2021-09-22
from glob GitHub release notes7.2.3
7.2.2
7.2.0
Package name: https-proxy-agent
-
5.0.1 - 2022-04-14
-
5.0.0 - 2020-02-07
from https-proxy-agent GitHub release notesPackage name: socks-proxy-agent
-
6.2.1 - 2022-05-31
-
6.2.0 - 2022-04-17
-
6.2.0-beta.1 - 2022-02-15
-
6.2.0-beta.0 - 2022-02-12
-
6.1.1 - 2021-11-22
from socks-proxy-agent GitHub release notesPackage name: stack-utils
-
2.0.6 - 2022-11-08
-
2.0.5 - 2021-09-17
from stack-utils GitHub release notes2.0.6
No content.
Package name: ws
-
8.18.0 - 2024-07-03
- Added support for
-
8.17.1 - 2024-06-16
- Fixed a DoS vulnerability (#2231).
const http = require('http');
- Reduce the maximum allowed length of the request headers using the
- Set
-
8.17.0 - 2024-04-28
- The
- The default value of the
-
8.16.0 - 2023-12-26
- Added the
-
8.15.1 - 2023-12-12
- The
-
8.15.0 - 2023-12-09
- Added the
-
8.14.2 - 2023-09-19
- Fixed an issue that allowed errors thrown by failed assertions to be
-
8.14.1 - 2023-09-08
-
8.14.0 - 2023-09-06
-
8.13.0 - 2023-03-10
-
8.12.1 - 2023-02-13
-
8.12.0 - 2023-01-07
-
8.11.0 - 2022-11-06
-
8.10.0 - 2022-10-24
-
8.9.0 - 2022-09-22
-
8.8.1 - 2022-07-15
-
8.8.0 - 2022-06-09
-
8.7.0 - 2022-05-26
-
8.6.0 - 2022-05-01
-
8.5.0 - 2022-02-07
-
8.4.2 - 2022-01-14
from ws GitHub release notesFeatures
Blob(#2229).Bug fixes
A request with a number of headers exceeding the
server.maxHeadersCountthreshold could be used to crash a ws server.
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in #2230.
In vulnerable versions of ws, the issue can be mitigated in the following ways:
--max-http-header-size=sizeand/or themaxHeaderSizeoptions sothat no more headers than the
server.maxHeadersCountlimit can be sent.server.maxHeadersCountto0so that no limit is applied.Features
WebSocketconstructor now accepts thecreateConnectionoption (#2219).Other notable changes
allowSynchronousEventsoption has been changed totrue(#2221).This is a breaking change in a patch release. The assumption is that the option
is not widely used.
Features
autoPongoption (01ba54e).Notable changes
allowMultipleEventsPerMicrotaskoption has been renamed toallowSynchronousEvents(4ed7fe5).This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.
Features
allowMultipleEventsPerMicrotaskoption (93e3552).Bug fixes
swallowed when running tests (7f4e1a7).
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: