chore(deps): update dependency ws to v5.2.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ws	5.2.2 -> 5.2.3

GitHub Vulnerability Alerts

CVE-2021-32640

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in [email protected] (websockets/ws@00c425e) and backported to [email protected] (websockets/ws@78c676d) and [email protected] (websockets/ws@76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

---

Release Notes

websockets/ws

v5.2.3

Compare Source

Bug fixes

• Backported 00c425e to the 5.x release line (76d47c1).

---

Configuration

📅 Schedule: "" in timezone America/New_York.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.

[cypress-bot]

See the guidelines for reviewing dependency updates for info on how to review dependency update PRs.

[flotwig]

devDependency

[cypress]

---

Test summary

200 • 0 • 1 • 0 • 0

---

Run details

Project	cypress
Status	Passed
Commit	f57071e
Started	Jun 9, 2021 7:56 PM
Ended	Jun 9, 2021 8:05 PM
Duration	08:55 💡
OS	Linux Debian - 10.8
Browser	Electron 89

View run in Cypress Dashboard ➡️

---

This comment has been generated by cypress-bot as a result of this project's GitHub integration settings. You can manage this integration in this project's settings in the Cypress Dashboard

[jennifer-shehane]

Great, backport fix so we don't have to upgrade to 7.0. Although this is not a vulnerability we need to worry about, going to approve to close this PR.