6902e55256
Summary: Bumps [ws](https://github.com/websockets/ws) from 7.3.0 to 7.4.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>7.4.6</h2> <h1>Bug fixes</h1> <ul> <li>Fixed a ReDoS vulnerability (00c425ec).</li> </ul> <p>A specially crafted value of the <code>Sec-Websocket-Protocol</code> header could be used to significantly slow down a ws server.</p> <pre lang="js"><code>for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) { const value = 'b' + ' '.repeat(length) + 'x'; const start = process.hrtime.bigint(); <p>value.trim().split(/ *, */);</p> <p>const end = process.hrtime.bigint();</p> <p>console.log('length = %d, time = %f ns', length, end - start); } </code></pre></p> <p>The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.</p> <p>In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the <a href="https://nodejs.org/api/cli.html#cli_max_http_header_size_size"><code>--max-http-header-size=size</code></a> and/or the <a href="https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener"><code>maxHeaderSize</code></a> options.</p> <h2>7.4.5</h2> <h1>Bug fixes</h1> <ul> <li>UTF-8 validation is now done even if <code>utf-8-validate</code> is not installed (23ba6b29).</li> <li>Fixed an edge case where <code>websocket.close()</code> and <code>websocket.terminate()</code> did not close the connection (67e25ff5).</li> </ul> <h2>7.4.4</h2> <h1>Bug fixes</h1> <ul> <li>Fixed a bug that could cause the process to crash when using the permessage-deflate extension (92774377).</li> </ul> <h2>7.4.3</h2> <h1>Bug fixes</h1> <ul> <li>The deflate/inflate stream is now reset instead of reinitialized when context takeover is disabled (<a href="https://github-redirect.dependabot.com/websockets/ws/issues/1840">https://github.com/facebook/flipper/issues/1840</a>).</li> </ul> <h2>7.4.2</h2> <h1>Bug fixes</h1> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="f5297f7090"><code>f5297f7</code></a> [dist] 7.4.6</li> <li><a href="00c425ec77"><code>00c425e</code></a> [security] Fix ReDoS vulnerability</li> <li><a href="990306d144"><code>990306d</code></a> [lint] Fix prettier error</li> <li><a href="32e3a8439b"><code>32e3a84</code></a> [security] Remove reference to Node Security Project</li> <li><a href="8c914d18b8"><code>8c914d1</code></a> [minor] Fix nits</li> <li><a href="fc7e27d12a"><code>fc7e27d</code></a> [ci] Test on node 16</li> <li><a href="587c201bfc"><code>587c201</code></a> [ci] Do not test on node 15</li> <li><a href="f672710797"><code>f672710</code></a> [dist] 7.4.5</li> <li><a href="67e25ff502"><code>67e25ff</code></a> [fix] Fix case where <code>abortHandshake()</code> does not close the connection</li> <li><a href="23ba6b2922"><code>23ba6b2</code></a> [fix] Make UTF-8 validation work even if utf-8-validate is not installed</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/7.3.0...7.4.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `dependabot rebase` will rebase this PR - `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `dependabot merge` will merge this PR after your CI passes on it - `dependabot squash and merge` will squash and merge this PR after your CI passes on it - `dependabot cancel merge` will cancel a previously requested merge and block automerging - `dependabot reopen` will reopen this PR if it is closed - `dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Pull Request resolved: https://github.com/facebook/flipper/pull/2371 Reviewed By: passy Differential Revision: D28714468 Pulled By: nikoant fbshipit-source-id: c2a3a7091599f29d453a35bf89bab4a03817509c
99 lines
2.7 KiB
JSON
99 lines
2.7 KiB
JSON
{
|
|
"name": "flipper",
|
|
"version": "0.0.0",
|
|
"description": "Mobile development tool",
|
|
"productName": "Flipper",
|
|
"author": "Facebook Inc",
|
|
"main": "src/index.tsx",
|
|
"icon": "icon.png",
|
|
"category": "facebook-intern",
|
|
"privileged": true,
|
|
"license": "MIT",
|
|
"scripts": {
|
|
"reset": "rimraf lib *.tsbuildinfo",
|
|
"build": "tsc -b"
|
|
},
|
|
"dependencies": {
|
|
"@ant-design/icons": "^4.6.2",
|
|
"@emotion/css": "^11.1.3",
|
|
"@emotion/react": "^11.4.0",
|
|
"@emotion/styled": "^11.3.0",
|
|
"@iarna/toml": "^2.2.5",
|
|
"@tanishiking/aho-corasick": "^0.0.1",
|
|
"@types/archiver": "^5.1.0",
|
|
"@types/uuid": "^8.0.1",
|
|
"JSONStream": "^1.3.1",
|
|
"adbkit": "^2.11.1",
|
|
"adbkit-logcat": "^2.0.1",
|
|
"antd": "^4.15.6",
|
|
"archiver": "^5.0.2",
|
|
"async-mutex": "^0.3.1",
|
|
"axios": "^0.21.1",
|
|
"cbuffer": "^2.2.0",
|
|
"console-feed": "^3.2.2",
|
|
"crc32": "^0.2.2",
|
|
"deep-equal": "^2.0.5",
|
|
"expand-tilde": "^2.0.2",
|
|
"flipper-client-sdk": "^0.0.3",
|
|
"flipper-doctor": "0.0.0",
|
|
"flipper-plugin": "0.0.0",
|
|
"flipper-plugin-lib": "0.0.0",
|
|
"fs-extra": "^10.0.0",
|
|
"immer": "^9.0.2",
|
|
"immutable": "^4.0.0-rc.12",
|
|
"invariant": "^2.2.2",
|
|
"lodash": "^4.17.21",
|
|
"lodash.memoize": "^4.1.2",
|
|
"open": "^8.0.8",
|
|
"openssl-wrapper": "^0.3.4",
|
|
"p-filter": "^2.1.0",
|
|
"p-map": "^4.0.0",
|
|
"promise-retry": "^2.0.1",
|
|
"promisify-child-process": "^4.1.0",
|
|
"prop-types": "^15.6.0",
|
|
"query-string": "^7.0.0",
|
|
"react": "17.0.2",
|
|
"react-async": "^10.0.0",
|
|
"react-debounce-render": "^7.0.0",
|
|
"react-dom": "^17.0.1",
|
|
"react-element-to-jsx-string": "^14.3.1",
|
|
"react-markdown": "^6.0.2",
|
|
"react-player": "^2.9.0",
|
|
"react-redux": "^7.2.4",
|
|
"react-test-renderer": "^17.0.1",
|
|
"react-transition-group": "^4.4.1",
|
|
"react-virtualized-auto-sizer": "^1.0.5",
|
|
"react-window": "^1.8.6",
|
|
"recursive-readdir": "^2.2.2",
|
|
"redux": "^4.1.0",
|
|
"redux-persist": "^6.0.0",
|
|
"rsocket-core": "^0.0.19",
|
|
"rsocket-flowable": "^0.0.25",
|
|
"rsocket-tcp-server": "^0.0.25",
|
|
"rsocket-types": "^0.0.25",
|
|
"semver": "^7.3.5",
|
|
"split2": "^3.2.2",
|
|
"tmp": "^0.2.1",
|
|
"uuid": "^8.3.2",
|
|
"which": "^2.0.1",
|
|
"ws": "^7.4.6",
|
|
"xdg-basedir": "^4.0.0"
|
|
},
|
|
"optionalDependencies": {
|
|
"7zip-bin-mac": "^1.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@testing-library/dom": "^7.31.0",
|
|
"@testing-library/react": "^11.2.7",
|
|
"@types/lodash.memoize": "^4.1.6",
|
|
"@types/split2": "^3.2.0",
|
|
"flipper-test-utils": "0.0.0",
|
|
"metro-runtime": "^0.65.2",
|
|
"mock-fs": "^4.14.0",
|
|
"pretty-format": "^26.1.0",
|
|
"react-refresh": "^0.10.0",
|
|
"redux-mock-store": "^1.0.1",
|
|
"ts-jest": "^26.5.6"
|
|
}
|
|
}
|