Update ws 8.18.3 → 8.20.1 (minor)

[depfu]

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ ws (8.18.3 → 8.20.1) · Repo

Release Notes

8.20.1

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close()
  (c0327ec).

Providing a TypedArray (e.g. Float32Array) as the reason argument for
websocket.close(), rather than the supported string or Buffer types, caused
uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(

{ port: 0, skipUTF8Validation: true },

function () {

const { port } = wss.address();

const ws = new WebSocket(ws://localhost:<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">port</span><span class="pl-kos">}</span></span>, {

skipUTF8Validation: true

});
<span class="pl-s1">ws</span><span class="pl-kos">.</span><span class="pl-en">on</span><span class="pl-kos">(</span><span class="pl-s">'close'</span><span class="pl-kos">,</span> <span class="pl-k">function</span> <span class="pl-kos">(</span><span class="pl-s1">code</span><span class="pl-kos">,</span> <span class="pl-s1">reason</span><span class="pl-kos">)</span> <span class="pl-kos">{</span>
  <span class="pl-en">deepStrictEqual</span><span class="pl-kos">(</span><span class="pl-s1">reason</span><span class="pl-kos">,</span> <span class="pl-v">Buffer</span><span class="pl-kos">.</span><span class="pl-en">alloc</span><span class="pl-kos">(</span><span class="pl-c1">80</span><span class="pl-kos">)</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-kos">}</span><span class="pl-kos">)</span><span class="pl-kos">;</span>

}

);
wss.on('connection', function (ws) {

ws.close(1000, new Float32Array(20));

});

The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

• Added exports for the PerMessageDeflate class and utilities for the
  Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1).

8.19.0

Features

• Added the closeTimeout option (#2308).

Bug fixes

• Handled a forthcoming breaking change in Node.js core (1998485).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 20 commits:

• [dist] 8.20.1
• [security] Fix uninitialized memory disclosure in `websocket.close()`
• [ci] Test on node 26
• [ci] Do not test on node 25
• [ci] Run the lint step on node 24
• [dist] 8.20.0
• [minor] Export the `PerMessageDeflate` class and header utils
• [api] Convert the `isServer` and `maxPayload` parameters to options
• [doc] Add missing space
• [pkg] Update eslint to version 10.0.1
• [pkg] Update globals to version 17.0.0
• [dist] 8.19.0
• [feature] Introduce the `closeTimeout` option (#2308)
• [fix] Ensure all remaining data is read as a single chunk
• [doc] Sort options alphabetically
• [ci] Update actions/checkout action to v6
• [ci] Update actions/setup-node action to v6
• [ci] Test on node 25
• [ci] Update actions/setup-node action to v5
• [ci] Update actions/checkout action to v5

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)