[CVE-2024-37890] Bump ws from 8.5.0 to 8.17.1 and from 7.5.7 to 7.5.10

[ananzh]

Description

https://nvd.nist.gov/vuln/detail/CVE-2024-37890 requests to bump ws from 8.5.0 to 8.17.1 and from 7.5.7 to 7.5.10

The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). 

Screenshot

=> Found "[email protected]"
info Reasons this module exists
   - "_project_#@percy#cli#@percy#cli-command#@percy#core" depends on it
   - Hoisted from "_project_#@percy#cli#@percy#cli-command#@percy#core#ws"
info Disk size without dependencies: "180KB"
info Disk size with unique dependencies: "180KB"
info Disk size with transitive dependencies: "180KB"
info Number of shared dependencies: 0
=> Found "jsdom#[email protected]"
info This module exists because "_project_#jest#@jest#core#jest-config#jest-environment-jsdom#jsdom" depends on it.
info Disk size without dependencies: "168KB"
info Disk size with unique dependencies: "168KB"
info Disk size with transitive dependencies: "168KB"
info Number of shared dependencies: 0
Done in 1.28s.

Changelog

• security: [CVE-2024-37890] Bump ws from 8.5.0 to 8.17.1 and from 7.5.7 to 7.5.10

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.49%. Comparing base (027122e) to head (01d649a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7153      +/-   ##
==========================================
+ Coverage   67.47%   67.49%   +0.01%     
==========================================
  Files        3468     3468              
  Lines       68366    68366              
  Branches    11110    11110              
==========================================
+ Hits        46133    46145      +12     
+ Misses      19579    19522      -57     
- Partials     2654     2699      +45     

Flag	Coverage Δ
Linux_1	33.05% <ø> (ø)
Linux_2	55.18% <ø> (ø)
Linux_3	45.36% <ø> (+0.01%)	⬆️
Linux_4	34.77% <ø> (ø)
Windows_1	33.07% <ø> (?)
Windows_2	55.14% <ø> (ø)
Windows_3	45.36% <ø> (ø)
Windows_4	34.77% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[c3-clement]

Hello @ananzh,
Thanks for patching this vulnerability.

Will this fix be back-ported in 2.15?
Or will it be shipped only in 2.16?

Thanks.