Created by: renovate[bot]
This PR contains the following updates:
Package | Change | Age | Adoption | Passing | Confidence |
---|---|---|---|---|---|
ws | ^3.0.0 -> ^8.0.0 |
Release Notes
websockets/ws
v8.13.0
Features
- Added the
finishRequest
option to support late addition of headers (#2123).
v8.12.1
Bug fixes
- Added
browser
condition to package.json (#2118).
v8.12.0
Features
- Added support for
utf-8-validate@6
(ff63bba
).
Other notable changes
- [
buffer.isUtf8()
][buffer.isUtf8()] is now used instead ofutf-8-validate
if available (42d79f6
).
v8.11.0
Features
-
WebSocket.prototype.addEventListener()
now supports an event listener specified as an object with ahandleEvent()
method. (9ab743a
).
Bug fixes
-
WebSocket.prototype.addEventListener()
now adds an event listener only if it is not already in the list of the event listeners for the specified event type (1cec17d
).
v8.10.0
Features
- Added an export for package.json (
211d5d3
).
v8.9.0
Features
- Added the ability to connect to Windows named pipes (#2079).
v8.8.1
Bug fixes
- The
Authorization
andCookie
headers are no longer sent if the original request for the opening handshake is sent to an IPC server and the client is redirected to another IPC server (bc8bd34
).
v8.8.0
Features
- Added the
WS_NO_BUFFER_UTIL
andWS_NO_UTF_8_VALIDATE
environment variables (becf237
).
v8.7.0
Features
- Added the ability to inspect the invalid handshake requests and respond to
them with a custom HTTP response. (
6e5a5ce
).
Bug fixes
- The handshake is now aborted if the
Upgrade
header field value in the HTTP response is not a case-insensitive match for the value "websocket" (0fdcc0a
). - The
Authorization
andCookie
headers are no longer sent when following an insecure redirect (wss: to ws:) to the same host (d68ba9e
).
v8.6.0
Features
- Added the ability to remove confidential headers on a per-redirect basis (#2030).
v8.5.0
Features
- Added the ability to use a custom
WebSocket
class on the server (#2007).
Bug fixes
- When following redirects, the
Authorization
andCookie
headers are no longer sent if the redirect host is different from the original host (#2013).
v8.4.2
Bug fixes
- Fixed a data framing issue introduced in version 8.4.1 (#2004).
v8.4.1
Notable changes
- To improve performance, strings sent via
websocket.ping()
,websocket.pong()
, andwebsocket.send()
are no longer converted toBuffer
s if the data does not need to be masked (#2000).
v8.4.0
Features
- Added ability to generate custom masking keys (#1990).
v8.3.0
Features
- Added ability to pause and resume a
WebSocket
(0a8c7a9
).
Bug fixes
- Fixed a bug that could prevent the connection from being closed cleanly when
using the stream API (
ed2b803
). - When following redirects, an error is now emitted and not thrown if the redirect URL is invalid (#1980).
v8.2.3
Bug fixes
- When context takeover is enabled, messages are now compressed even if their size
is below the value of the
perMessageDeflate.threshold
option (41ae563
).
v8.2.2
Bug fixes
- Some closing operations are now run only if needed (
ec9377c
).
v8.2.1
Bug fixes
- Fixed an issue where the socket was not resumed, preventing the connection
from being closed cleanly (
869c989
).
v8.2.0
Features
- Added
WebSocket.WebSocket
as an alias forWebSocket
andWebSocket.WebSocketServer
as an alias forWebSocket.Server
to fix name consistency and improve interoperability with the ES module wrapper (#1935).
v8.1.0
Features
- Added ability to skip UTF-8 validation (#1928).
Bug fixes
- Fixed an issue with a breaking change in Node.js master (
6a72da3
). - Fixed a misleading error message (
c95e695
).
v8.0.0
Breaking changes
-
The
WebSocket
constructor now throws aSyntaxError
if any of the subprotocol names are invalid or duplicated (0aecf0c
). -
The server now aborts the opening handshake if an invalid
Sec-WebSocket-Protocol
header field value is received (1877dde
). -
The
protocols
argument ofhandleProtocols
hook is no longer anArray
but aSet
(1877dde
). -
The opening handshake is now aborted if the
Sec-WebSocket-Extensions
header field value is empty or it begins or ends with a white space (e814110
). -
Dropped support for Node.js < 10.0.0 (
552b506
). -
The
WebSocket
constructor now throws aSyntaxError
if the connection URL contains a fragment identifier or if the URL's protocol is not one of'ws:'
,'wss:'
, or'ws+unix:'
(ebea038
). -
Text messages and close reasons are no longer decoded to strings. They are passed as
Buffer
s to the listeners of their respective events. The listeners of the'message'
event now take a boolean argument specifying whether or not the message is binary (e173423
).Existing code can be migrated by decoding the buffer explicitly.
websocket.on('message', function message(data, isBinary) { const message = isBinary ? data : data.toString(); // Continue as before. }); websocket.on('close', function close(code, data) { const reason = data.toString(); // Continue as before. });
-
The package now uses an ES module wrapper (
78adf5f
). -
WebSocketServer.prototype.close()
no longer closes existing connections (df7de57
).Existing code can be migrated by closing the connections manually.
websocketServer.close(); for (const ws of websocketServer.clients) { ws.terminate(); }
-
The callback of
WebSocketServer.prototype.close()
is now called with an error if the server is already closed (abde9cf
). -
WebSocket.prototype.addEventListener()
is now a noop if thetype
argument is not one of'close'
,'error'
,'message'
, or'open'
(9558ed1
). -
WebSocket.prototype.removeEventListener()
now only removes listeners added withWebSocket.prototype.addEventListener()
and only one at time (ea95d9c
). -
The value of the
onclose
,onerror
,onmessage
, andonopen
properties is nownull
if the respective event handler is not set (6756cf5
). -
The
OpenEvent
class has been removed (21e6500
).
Bug fixes
- The event listeners added via handler properties are now independent from the
event listeners added with
WebSocket.prototype.addEventListener()
(0b21c03
).
v7.5.9
Bug fixes
v7.5.8
Bug fixes
- Backported
0fdcc0a
to the 7.x release line (2758ed3
). - Backported
d68ba9e
to the 7.x release line (dc1781b
).
v7.5.7
Bug fixes
v7.5.6
Bug fixes
- Backported
b8186dd
to the 7.x release line (73dec34
). - Backported
ed2b803
to the 7.x release line (22a26af
).
v7.5.5
Bug fixes
v7.5.4
Bug fixes
- Backported
6a72da3
to the 7.x release line (76087fb
). - Backported
869c989
to the 7.x release line (2799793
).
v7.5.3
Bug fixes
- The
WebSocketServer
constructor now throws an error if more than one of thenoServer
,server
, andport
options are specefied (66e58d2
). - Fixed a bug where a
'close'
event was emitted by aWebSocketServer
before the internal HTTP/S server was actually closed (5a58730
). - Fixed a bug that allowed WebSocket connections to be established after
WebSocketServer.prototype.close()
was called (772236a
).
v7.5.2
Bug fixes
- The opening handshake is now aborted if the client receives a
Sec-WebSocket-Extensions
header but no extension was requested or if the server indicates an extension not requested by the client (aca94c8
).
v7.5.1
Bug fixes
- Fixed an issue that prevented the connection from being closed properly if an
error occurred simultaneously on both peers (
b434b9f
).
v7.5.0
Features
- Some errors now have a
code
property describing the specific type of error that has occurred (#1901).
Bug fixes
- A close frame is now sent to the remote peer if an error (such as a data
framing error) occurs (
8806aa9
). - The close code is now always 1006 if no close frame is received, even if the
connection is closed due to an error (
8806aa9
).
v7.4.6
Bug fixes
- Fixed a ReDoS vulnerability (
00c425e
).
A specially crafted value of the Sec-Websocket-Protocol
header could be used
to significantly slow down a ws server.
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
const value = 'b' + ' '.repeat(length) + 'x';
const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}
The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.
In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize
options.
v7.4.5
Bug fixes
- UTF-8 validation is now done even if
utf-8-validate
is not installed (23ba6b2
). - Fixed an edge case where
websocket.close()
andwebsocket.terminate()
did not close the connection (67e25ff
).
v7.4.4
Bug fixes
- Fixed a bug that could cause the process to crash when using the
permessage-deflate extension (
9277437
).
v7.4.3
Bug fixes
- The deflate/inflate stream is now reset instead of reinitialized when context takeover is disabled (#1840).
v7.4.2
Bug fixes
- Silenced a deprecation warning (
a2c0d44
).
v7.4.1
Bug fixes
- Added a workaround for a double
'error'
event bug in Node.js < 13 which caused an uncaught error during the WebSocket handshake (38d6ab3
).
v7.4.0
Features
- The callback of
WebSocketServer.prototype.handleUpgrade()
now takes the client HTTP GET request as second argument (7d39f19
).
Bug fixes
- Read-only properties are now read-only (
eabed8f
). - The
CONNECTING
,OPEN
,CLOSING
,CLOSED
,binaryType
,bufferedAmount
,extensions
,onclose
,onerror
,onmessage
,onopen
,protocol
,readyState
, andurl
properties are now enumerable (2069e68
).
v7.3.1
Bug fixes
v7.3.0
Features
-
WebSocket.prototype.addEventListener()
now supports theonce
option (#1754).
v7.2.5
Bug fixes
- Fixed compatibility with Node.js master (
651d662
).
v7.2.3
Bug fixes
-
WebSocket#{p{i,o}ng,close}()
now thow an error if the data to send is too large to fit in a control frame (e54f08d
).
v7.2.2
Bug fixes
- Fixed an issue where calling
webSocketStream.end()
could cause the process to crash (9535702
). - The connection is now closed if a non-masked frame is received on the server or a masked frame is received on the client (#1681).
- The status code 1014 is now allowed to be used (#1682).
v7.2.1
Bug fixes
- Added
bufferutil
andutf-8-validate
as peer dependencies (#1626).
v7.2.0
Features
- Added ability to specify the
readableObjectMode
option when usingWebSocket.createWebSocketStream()
(#1647).
v7.1.2
Bug fixes
- Fixed a bug that caused compress jobs to never be marked as complete (#1618).
v7.1.1
Bug fixes
- An error is now thrown if the
WebSocket
server constructor is used incorrectly (3641266
).
v7.1.0
Features
- Added utility to wrap a
WebSocket
in aDuplex
stream (#1589).
Bug fixes
v7.0.1
Bug fixes
- Added ability to disable sending the SNI extension (#1587).
v7.0.0
Breaking changes
- Dropped support for Node.js 6 (
1e6999b
). - Dropped support for
url.Url
instances in theWebSocket
constructor (692d7b4
). - The behavior of
WebSocket#{p{i,o}ng,send}()
has changed when thereadyState
attribute is notOPEN
(#1532)- If the readyState attribute is
CONNECTING
, an exception is thrown. - If the readyState attribute is
CLOSING
orCLOSED
- The
bufferedAmount
attribute is increased by the length of thedata
argument in bytes. - If provided, the
callback
function is called with an error. - No exception is thrown even if the
callback
function is not provided.
- The
- If the readyState attribute is
v6.2.2
Bug fixes
v6.2.1
Bug fixes
- Fixed a bug that, under certain circumstances, prevented the close timer from
being set (
aa1dcd5
).
v6.2.0
Features
- Added ability to follow redirects (#1490).
Bug fixes
- The opening handshake is now aborted if the
Sec-WebSocket-Key
header field value is invalid (160af45
).
v6.1.4
Bug fixes
- Fixed an issue that caused the
Host
header to always include a port (#1510).
v6.1.3
Bug fixes
- Fixed a bug that, under certain circumstances, prevented the close frame from being parsed (#1494).
v6.1.2
Bug fixes
- Restored compatibility with Node.js < 6.13.0 (
26436e0
).
v6.1.1
Bug fixes
- Queued messages to send are now discarded if the permessage-deflate is enabled and the socket closes prematurely (#1464, #1471).
v6.1.0
Features
- The WebSocket server now emits a
'close'
event when the server closes (#1453).
v6.0.0
Breaking changes
- Dropped support for Node.js 4 (
d73885c
). - Added a shim that throws an error when used if the package is bundled for the browser (#1345).
- Added a
maxPayload
option on the client. Defaults to 100 MiB (#1402). - Dropped support for the
memLevel
andlevel
options. UsezlibDeflateOptions
instead. (80e2002
).
v5.2.3
Bug fixes
v5.2.2
Bug fixes
v5.2.1
Bug fixes
- Fixed a bug that could prevent buffered data from being processed under
certain circumstances (
6046a28
).
v5.2.0
Features
- Added ability to specify custom headers when rejecting the handshake (#1379).
v5.1.1
Bug fixes
v5.1.0
Features
- The
address
argument of theWebSocket
constructor can now be a [URL
][URL] instance (#1329). - The
options
argument of theWebSocket
constructor now accepts any TLS option that is also accepted by [https.request()
][https.request()] (#1332).
v5.0.0
Breaking changes
- Dropped support for Node.js < 4.5.0 (#1313).
- The connection is no longer closed if the server does not agree to any of the client's requested subprotocols (#1312).
-
net.Socket
errors are no longer re-emitted (a4050db
).
Features
- Read backpressure is now properly handled when permessage-deflate is enabled (#1302).
v4.1.0
Features
- Added
WebSocketServer.prototype.address()
(#1294). - Added
zlib{Deflate,Inflate}Options
options (#1306).
v4.0.0
Breaking changes
- The close status code is now set to 1005 if the received close frame contains
no status code (
a31b1f6
). - Error messages and types have been updated (
695c5ea
). - The
onerror
event handler now receives anErrorEvent
instead of JavaScript error (63e275e
). - The third argument of
WebSocket.prototype.ping()
andWebSocket.prototype.pong()
is no longer a boolean but an optional callback (30c9f71
). - The non-standard
protocolVersion
andbytesReceived
attributes have been removed (30c9f71
...ee9b5f3). - The
extensions
attribute is no longer an object but a string representing the extensions selected by the server (fdec524
). - The
'headers'
event on the client has been renamed to'upgrade'
. Listeners of this event now receive only theresponse
argument (1c783c2
). - The
WebSocket.prototype.pause()
andWebSocket.prototype.resume()
methods have been removed to prevent the user from interfering with the state of the underlyingnet.Socket
stream (a206e98
).
Configuration
-
If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.