Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 10, 2024

Bumps ws to 8.17.1 and updates ancestor dependencies ws, gatsby, gatsby-plugin-google-analytics, gatsby-plugin-manifest, gatsby-plugin-material-ui, gatsby-plugin-offline, gatsby-plugin-react-helmet, gatsby-plugin-react-intl, gatsby-plugin-sharp, gatsby-plugin-sitemap, gatsby-plugin-typography, gatsby-source-filesystem and gatsby-transformer-sharp. These dependencies need to be updated together.

Updates ws from 7.4.5 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • 934c9d6 [ci] Test on node 22
  • 1817bac [ci] Do not test on node 21
  • 96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
  • e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
  • Additional commits viewable in compare view

Updates gatsby from 3.15.0 to 5.13.7

Release notes

Sourced from gatsby's releases.

v5.13.0

Welcome to [email protected] release (December 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.12.0

Welcome to [email protected] release (August 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.11.0

Welcome to [email protected] release (June 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.10.0

Welcome to [email protected] release (May 2023 #1)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.9.0

Welcome to [email protected] release (April 2023 #1)

... (truncated)

Commits

Updates gatsby-plugin-google-analytics from 3.15.0 to 5.13.1

Release notes

Sourced from gatsby-plugin-google-analytics's releases.

v5.13.0

Welcome to [email protected] release (December 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.12.0

Welcome to [email protected] release (August 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.11.0

Welcome to [email protected] release (June 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.10.0

Welcome to [email protected] release (May 2023 #1)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.9.0

Welcome to [email protected] release (April 2023 #1)

... (truncated)

Changelog

Sourced from gatsby-plugin-google-analytics's changelog.

5.13.1 (2024-01-23)

Note: Version bump only for package gatsby-plugin-google-analytics

5.13.0 (2023-12-18)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-google-analytics

5.12.0 (2023-08-24)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-google-analytics

5.11.0 (2023-06-15)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-google-analytics

5.10.0 (2023-05-16)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-google-analytics

5.9.0 (2023-04-18)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-google-analytics

5.8.0 (2023-03-21)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-google-analytics

5.7.0 (2023-02-21)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-google-analytics

5.6.0 (2023-02-07)

🧾 Release notes

... (truncated)

Commits

Updates gatsby-plugin-manifest from 3.15.0 to 5.13.1

Release notes

Sourced from gatsby-plugin-manifest's releases.

v5.13.0

Welcome to [email protected] release (December 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.12.0

Welcome to [email protected] release (August 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.11.0

Welcome to [email protected] release (June 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.10.0

Welcome to [email protected] release (May 2023 #1)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.9.0

Welcome to [email protected] release (April 2023 #1)

... (truncated)

Changelog

Sourced from gatsby-plugin-manifest's changelog.

5.13.1 (2024-01-23)

Note: Version bump only for package gatsby-plugin-manifest

5.13.0 (2023-12-18)

🧾 Release notes

Chores

5.12.3 (2023-10-26)

Note: Version bump only for package gatsby-plugin-manifest

5.12.2 (2023-10-20)

Note: Version bump only for package gatsby-plugin-manifest

5.12.1 (2023-10-09)

Chores

5.12.0 (2023-08-24)

🧾 Release notes

Bug Fixes

5.11.0 (2023-06-15)

🧾 Release notes

Chores

5.10.0 (2023-05-16)

🧾 Release notes

Bug Fixes

... (truncated)

Commits

Updates gatsby-plugin-material-ui from 3.0.1 to 4.1.0

Commits

Updates gatsby-plugin-offline from 4.15.0 to 6.13.2

Release notes

Sourced from gatsby-plugin-offline's releases.

v5.13.0

Welcome to [email protected] release (December 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.12.0

Welcome to [email protected] release (August 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.11.0

Welcome to [email protected] release (June 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.10.0

Welcome to [email protected] release (May 2023 #1)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.9.0

Welcome to [email protected] release (April 2023 #1)

... (truncated)

Changelog

Sourced from gatsby-plugin-offline's changelog.

6.13.2 (2024-04-10)

Bug Fixes

6.13.1 (2024-01-23)

Note: Version bump only for package gatsby-plugin-offline

6.13.0 (2023-12-18)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-offline

6.12.3 (2023-10-26)

Note: Version bump only for package gatsby-plugin-offline

6.12.2 (2023-10-20)

Note: Version bump only for package gatsby-plugin-offline

6.12.1 (2023-10-09)

Note: Version bump only for package gatsby-plugin-offline

6.12.0 (2023-08-24)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-offline

6.11.0 (2023-06-15)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-offline

6.10.0 (2023-05-16)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-offline

6.9.0 (2023-04-18)

🧾 Release notes

... (truncated)

Commits

Updates gatsby-plugin-react-helmet from 4.15.0 to 6.13.1

Release notes

Sourced from gatsby-plugin-react-helmet's releases.

v5.13.0

Welcome to [email protected] release (December 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.12.0

Welcome to [email protected] release (August 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.11.0

Welcome to [email protected] release (June 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.10.0

Welcome to [email protected] release (May 2023 #1)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.9.0

Welcome to [email protected] release (April 2023 #1)

... (truncated)

Changelog

Sourced from gatsby-plugin-react-helmet's changelog.

6.13.1 (2024-01-23)

Note: Version bump only for package gatsby-plugin-react-helmet

6.13.0 (2023-12-18)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-react-helmet

6.12.0 (2023-08-24)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-react-helmet

6.11.0 (2023-06-15)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-react-helmet

6.10.0 (2023-05-16)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-react-helmet

6.9.0 (2023-04-18)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-react-helmet

6.8.0 (2023-03-21)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-react-helmet

6.7.0 (2023-02-21)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-react-helmet

6.6.0 (2023-02-07)

🧾 Release notes

... (truncated)

Commits

Updates gatsby-plugin-react-intl from 3.0.2 to 4.0.0

Commits

Updates gatsby-plugin-sharp from 3.15.0 to 5.13.1

Release notes

Sourced from gatsby-plugin-sharp's releases.

v5.13.0

Welcome to [email protected] release (December 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.12.0

Welcome to [email protected] release (August 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.11.0

Welcome to [email protected] release (June 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.10.0

Welcome to [email protected] release (May 2023 #1)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.9.0

Welcome to [email protected] release (April 2023 #1)

... (truncated)

Changelog

Sourced from gatsby-plugin-sharp's changelog.

5.13.1 (2024-01-23)

Note: Version bump only for package gatsby-plugin-sharp

5.13.0 (2023-12-18)

🧾 Release notes

Chores

5.12.3 (2023-10-26)

Note: Version bump only for package gatsby-plugin-sharp

5.12.2 (2023-10-20)

Note: Version bump only for package gatsby-plugin-sharp

5.12.1 (2023-10-09)

Chores

5.12.0 (2023-08-24)

🧾 Release notes

Bug Fixes

5.11.0 (2023-06-15)

🧾 Release notes

Chores

5.10.0 (2023-05-16)

🧾 Release notes

Bug Fixes

... (truncated)

Commits

Updates gatsby-plugin-sitemap from 4.11.0 to 6.13.1

Release notes

Sourced from gatsby-plugin-sitemap's releases.

v5.13.0

Welcome to [email protected] release (December 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.12.0

Welcome to [email protected] release (August 2023 #1)

Key highlight of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

v5.11.0

Welcome to [email protected] release (June 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.10.0

Welcome to [email protected] release (May 2023 #1)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.9.0

Welcome to [email protected] release (April 2023 #1)

... (truncated)

Changelog

Sourced from gatsby-plugin-sitemap's changelog.

6.13.1 (2024-01-23)

Note: Version bump only for package gatsby-plugin-sitemap

6.13.0 (2023-12-18)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-sitemap

6.12.3 (2023-10-26)

Note: Version bump only for package gatsby-plugin-sitemap

6.12.2 (2023-10-20)

Note: Version bump only for package gatsby-plugin-sitemap

6.12.1 (2023-10-09)

Note: Version bump only for package gatsby-plugin-sitemap

6.12.0 (2023-08-24)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-sitemap

6.11.0 (2023-06-15)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-sitemap

6.10.0 (2023-05-16)

🧾 Release notes

Note: Version bump only for package gatsby-plugin-sitemap

6.9.0 (2023-04-18)

…st, gatsby-plugin-material-ui, gatsby-plugin-offline, gatsby-plugin-react-helmet, gatsby-plugin-react-intl, gatsby-plugin-sharp, gatsby-plugin-sitemap, gatsby-plugin-typography, gatsby-source-filesystem and gatsby-transformer-sharp

Bumps [ws](https://github.com/websockets/ws) to 8.17.1 and updates ancestor dependencies [ws](https://github.com/websockets/ws), [gatsby](https://github.com/gatsbyjs/gatsby), [gatsby-plugin-google-analytics](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-plugin-google-analytics), [gatsby-plugin-manifest](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-plugin-manifest), [gatsby-plugin-material-ui](https://github.com/hupe1980/gatsby-plugin-material-ui), [gatsby-plugin-offline](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-plugin-offline), [gatsby-plugin-react-helmet](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-plugin-react-helmet), [gatsby-plugin-react-intl](https://github.com/theowenyoung/gatsby-plugin-intl), [gatsby-plugin-sharp](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-plugin-sharp), [gatsby-plugin-sitemap](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-plugin-sitemap), [gatsby-plugin-typography](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-plugin-typography), [gatsby-source-filesystem](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-source-filesystem) and [gatsby-transformer-sharp](https://github.com/gatsbyjs/gatsby/tree/HEAD/packages/gatsby-transformer-sharp). These dependencies need to be updated together.


Updates `ws` from 7.4.5 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.4.5...8.17.1)

Updates `gatsby` from 3.15.0 to 5.13.7
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/compare/[email protected]@5.13.7)

Updates `gatsby-plugin-google-analytics` from 3.15.0 to 5.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-plugin-google-analytics/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-plugin-google-analytics)

Updates `gatsby-plugin-manifest` from 3.15.0 to 5.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-plugin-manifest/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-plugin-manifest)

Updates `gatsby-plugin-material-ui` from 3.0.1 to 4.1.0
- [Commits](hupe1980/gatsby-plugin-material-ui@v3.0.1...v4.1.0)

Updates `gatsby-plugin-offline` from 4.15.0 to 6.13.2
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-plugin-offline/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-plugin-offline)

Updates `gatsby-plugin-react-helmet` from 4.15.0 to 6.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-plugin-react-helmet/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-plugin-react-helmet)

Updates `gatsby-plugin-react-intl` from 3.0.2 to 4.0.0
- [Commits](theowenyoung/gatsby-plugin-intl@3.0.2...4.0.0)

Updates `gatsby-plugin-sharp` from 3.15.0 to 5.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-plugin-sharp/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-plugin-sharp)

Updates `gatsby-plugin-sitemap` from 4.11.0 to 6.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-plugin-sitemap/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-plugin-sitemap)

Updates `gatsby-plugin-typography` from 3.15.0 to 5.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-plugin-typography/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-plugin-typography)

Updates `gatsby-source-filesystem` from 3.15.0 to 5.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-source-filesystem/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-source-filesystem)

Updates `gatsby-transformer-sharp` from 3.15.0 to 5.13.1
- [Release notes](https://github.com/gatsbyjs/gatsby/releases)
- [Changelog](https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-transformer-sharp/CHANGELOG.md)
- [Commits](https://github.com/gatsbyjs/gatsby/commits/[email protected]/packages/gatsby-transformer-sharp)

---
updated-dependencies:
- dependency-name: ws
  dependency-type: indirect
- dependency-name: gatsby
  dependency-type: direct:production
- dependency-name: gatsby-plugin-google-analytics
  dependency-type: direct:production
- dependency-name: gatsby-plugin-manifest
  dependency-type: direct:production
- dependency-name: gatsby-plugin-material-ui
  dependency-type: direct:production
- dependency-name: gatsby-plugin-offline
  dependency-type: direct:production
- dependency-name: gatsby-plugin-react-helmet
  dependency-type: direct:production
- dependency-name: gatsby-plugin-react-intl
  dependency-type: direct:production
- dependency-name: gatsby-plugin-sharp
  dependency-type: direct:production
- dependency-name: gatsby-plugin-sitemap
  dependency-type: direct:production
- dependency-name: gatsby-plugin-typography
  dependency-type: direct:production
- dependency-name: gatsby-source-filesystem
  dependency-type: direct:production
- dependency-name: gatsby-transformer-sharp
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Aug 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant