[Snyk] Upgrade ws from 7.4.6 to 7.5.0

[snyk-bot]

Snyk has created this PR to upgrade ws from 7.4.6 to 7.5.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.
• The recommended version was released 22 days ago, on 2021-06-16.

Release notes

Package name: ws

• 7.5.0 - 2021-06-16
  

  Features

  • Some errors now have a code property describing the specific type of error
    that has occurred (#1901).

  Bug fixes

  • A close frame is now sent to the remote peer if an error (such as a data
    framing error) occurs (8806aa9).
  • The close code is now always 1006 if no close frame is received, even if the
    connection is closed due to an error (8806aa9).
• 7.4.6 - 2021-05-25
  

  Bug fixes

  • Fixed a ReDoS vulnerability (00c425e).

  A specially crafted value of the Sec-Websocket-Protocol header could be used
  to significantly slow down a ws server.

  for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ , /);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
  }

  The vulnerability was responsibly disclosed along with a fix in private by
  Robert McLaughlin from University of California, Santa Barbara.

  In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
  allowed length of the request headers using the --max-http-header-size=size
  and/or the maxHeaderSize options.

from ws GitHub release notes

Commit messages

Package name: ws

• e3f0c17 [dist] 7.5.0
• 1d3f4cb [doc] Fix anchor tags for error codes
• 6eea0d4 [doc] Fix typo
• bb5d44b [doc] Sort error codes alphabetically
• c6e3080 [minor] Attach error codes to all receiver errors (refactor: Bump puppeteer from 19.11.1 to 20.2.0 #1901)
• 074e6a8 [fix] Don't call `ws.terminate()` unconditionally in `duplex._destroy()`
• 8806aa9 [fix] Close the connection cleanly when an error occurs
• 05b8ccd [doc] Fix broken link (refactor: Bump @saithodev/semantic-release-backmerge from 2.1.3 to 3.2.0 #1897)
• 03a7078 [doc] Remove unsafe regex from code snippet
• 7ee3115 [doc] Add logo to coverage badge
• edff6bb [test] Fix nit
• 262e45a [test] Rename certificates and private keys files
• d18c677 [security] Update link to point to published security advisories
• 2f2b3e8 [test] Update certificates and private keys
• c05d51f [security] Add ReDoS vulnerability to SECURITY.md

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[codecov]

Codecov Report

Merging #1382 (9925486) into master (886f17d) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #1382   +/-   ##
=======================================
  Coverage   99.10%   99.10%           
=======================================
  Files          61       61           
  Lines        5943     5943           
  Branches     1350     1350           
=======================================
  Hits         5890     5890           
  Misses         52       52           
  Partials        1        1           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 886f17d...9925486. Read the comment docs.