[Snyk] Upgrade ws from 8.5.0 to 8.7.0

[snyk-bot]

Snyk has created this PR to upgrade ws from 8.5.0 to 8.7.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 2 versions ahead of your current version.
• The recommended version was released 22 days ago, on 2022-05-26.

Release notes

Package name: ws

• 8.7.0 - 2022-05-26
  

  Features

  • Added the ability to inspect the invalid handshake requests and respond to
    them with a custom HTTP response. (6e5a5ce).

  Bug fixes

  • The handshake is now aborted if the Upgrade header field value in the HTTP
    response is not a case-insensitive match for the value "websocket" (0fdcc0a).
  • The Authorization and Cookie headers are no longer sent when following an
    insecure redirect (wss: to ws:) to the same host (d68ba9e).
• 8.6.0 - 2022-05-01
  

  Features

  • Added the ability to remove confidential headers on a per-redirect basis (#2030).
• 8.5.0 - 2022-02-07
  

  Features

  • Added the ability to use a custom WebSocket class on the server (#2007).

  Bug fixes

  • When following redirects, the Authorization and Cookie headers are no
    longer sent if the redirect host is different from the original host (#2013).

from ws GitHub release notes

Commit messages

Package name: ws

• 4b62fbf [dist] 8.7.0
• 6e5a5ce [feature] Introduce the `'wsClientError'` event (Bump @babel/traverse from 7.22.8 to 7.23.2 in /hooks/generic-webhook/hook #2046)
• 903ec62 [doc] Update the type of the `socket` argument
• d68ba9e [security] Drop sensitive headers when following insecure redirects
• a690791 [ci] Exclude node 18 on Windows x86 from the test matrix
• 8889e48 [test] Increase code coverage
• fb658bd [minor] Use consistent error messages
• 0fdcc0a [fix] Abort the handshake if the Upgrade header is invalid
• e56cdfe [minor] Clarify why the handshake is aborted
• ba214d9 [dist] 8.6.0
• 8e3f118 [feature] Introduce the `'redirect'` event (📚 Recurring documentation issue #2030)
• 69e6828 [ci] Test on node 18
• 0b6eb71 [ci] Do not test on node 17
• d062ded [example] Fix require path
• 2cf6202 [example] Use the `WebSocket.WebSocket{,Server}` aliases
• 62e9b19 [doc] Fix nits
• 2619c00 [minor] Fix nit in comment
• d086f4b [minor] Make `abortHandshake()` emit the error in the next tick
• ff80d66 [test] Do not use a relative URL
• dd3d5a7 [doc] document the default value of the `maxPayload` option (Bump golang.org/x/net from 0.7.0 to 0.17.0 in /operator #2020)
• 9c18b1e [ci] Update actions/checkout action to v3
• 7cf94db [doc] Fix typo in code snippet (Bump golang.org/x/net from 0.7.0 to 0.17.0 in /auto-discovery/kubernetes #2018)
• a0524e1 [ci] Update actions/setup-node action to v3

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[github-actions]

MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ GIT	git_diff	yes		no	0.21s
✅ JSON	eslint-plugin-jsonc	2		0	1.81s
✅ JSON	jsonlint	2		0	0.86s
⚠️ JSON	prettier	2		1	0.85s
✅ JSON	v8r	2		0	5.46s
✅ SPELL	misspell	2		0	0.04s

See errors details in artifact MegaLinter reports on CI Job page
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff