Skip to content

chore(deps): bump ws from 8.18.3 to 8.20.1#1629

Merged
swadeley merged 1 commit into
masterfrom
dependabot/npm_and_yarn/ws-8.20.1
May 21, 2026
Merged

chore(deps): bump ws from 8.18.3 to 8.20.1#1629
swadeley merged 1 commit into
masterfrom
dependabot/npm_and_yarn/ws-8.20.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 20, 2026

Bumps ws from 8.18.3 to 8.20.1.

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

  • Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

  • Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).

8.19.0

Features

  • Added the closeTimeout option (#2308).

Bug fixes

  • Handled a forthcoming breaking change in Node.js core (19984854).
Commits
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • 8439255 [dist] 8.20.0
  • d3503c1 [minor] Export the PerMessageDeflate class and header utils
  • 3ee5349 [api] Convert the isServer and maxPayload parameters to options
  • 91707b4 [doc] Add missing space
  • 8b55319 [pkg] Update eslint to version 10.0.1
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file minor Minor dependency update labels May 20, 2026
@dependabot dependabot Bot requested a review from a team as a code owner May 20, 2026 11:30
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file minor Minor dependency update labels May 20, 2026
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented May 20, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.58%. Comparing base (ee372fc) to head (d226fae).

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #1629   +/-   ##
=======================================
  Coverage   77.58%   77.58%           
=======================================
  Files         103      103           
  Lines        3266     3266           
  Branches      729      729           
=======================================
  Hits         2534     2534           
  Misses        655      655           
  Partials       77       77           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/ws-8.20.1 branch from 47352a1 to a0ef898 Compare May 20, 2026 17:23
Bumps [ws](https://github.com/websockets/ws) from 8.18.3 to 8.20.1.
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.20.1)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/ws-8.20.1 branch from a0ef898 to d226fae Compare May 20, 2026 18:09
@swadeley swadeley self-assigned this May 21, 2026
Copy link
Copy Markdown
Collaborator

@swadeley swadeley left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK

@swadeley swadeley merged commit 098cb46 into master May 21, 2026
5 of 6 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/ws-8.20.1 branch May 21, 2026 07:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file minor Minor dependency update

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants