Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump ws from 7.4.5 to 7.4.6 #6

Merged
merged 1 commit into from
Jun 12, 2021
Merged

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jun 12, 2021

Bumps ws from 7.4.5 to 7.4.6.

Release notes

Sourced from ws's releases.

7.4.6

Bug fixes

  • Fixed a ReDoS vulnerability (00c425ec).

A specially crafted value of the Sec-Websocket-Protocol header could be used to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jun 12, 2021
@elisehein elisehein changed the base branch from main to staging June 12, 2021 11:04
@elisehein elisehein closed this Jun 12, 2021
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Jun 12, 2021

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@elisehein elisehein deleted the dependabot/npm_and_yarn/ws-7.4.6 branch June 12, 2021 11:05
@elisehein elisehein restored the dependabot/npm_and_yarn/ws-7.4.6 branch June 12, 2021 11:10
@elisehein elisehein reopened this Jun 12, 2021
@dependabot dependabot bot changed the base branch from staging to main June 12, 2021 11:11
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/ws-7.4.6 branch from 068b754 to d9be1b2 Compare June 12, 2021 11:11
* Add terser and JS compression script using foreach-cli

* Update CHANGELOG.
@elisehein elisehein force-pushed the dependabot/npm_and_yarn/ws-7.4.6 branch from d9be1b2 to 7c116d4 Compare June 12, 2021 11:13
@elisehein elisehein changed the base branch from main to staging June 12, 2021 11:15
@elisehein elisehein merged commit c3c0d39 into staging Jun 12, 2021
@elisehein elisehein deleted the dependabot/npm_and_yarn/ws-7.4.6 branch June 12, 2021 11:15
elisehein added a commit that referenced this pull request Jun 18, 2021
* Bump version to 1.0.1

* Minify CSS and JS in production (#4)

* Add CSS minification step to production build.

* Add terser and JS compression script using foreach-cli

* Update CHANGELOG.

* * Add CSS minification step to production build. (#6)

* Add terser and JS compression script using foreach-cli

* Update CHANGELOG.

Co-authored-by: Elise Hein <elisehein@gmail.com>

* GH Actions workflow for linting and testing (#7)

* Add lint and test GH workflow.

* Add .eslintignore to ignore test files.

* Fix some eslint errors.

* Fix some stylelint issues.

* Duration helper class (#8)

* Add a Duration helper object and make a start with conversions.

* Add shortcut properties for 1, 2, 3 second durations.

* Update CHANGELOG.

* Fix date in CHANGELOG.

* Fix links in CHANGELOG.

* A11y updates (#9)

* Adjust outline offsets.

* Use a different ARIA label for thumbnail diagram SVGs.

* Make pendulum arm keyboard focusable and clickable.

* Improve keyboard focusability by preventing outline on click, and make fig. 18 options keyboard focusable.

* Add fill animation to pendulum click overlay to better indicate clickability.

* Add aria-live, aria-selected and aria-current to the semantics between the toolbar and the figure.

* Hide the animated caption from screen readers and add an accessible, visually hidden caption.

The animated caption, even with role="text", was being read out letter
by letter.

Resources for the current approach:

- https://css-irl.info/how-to-accessibly-split-text/
- https://kittygiraudel.com/2021/02/17/hiding-content-responsibly/?ref=uxcollective

* Bump up max diagram size.

Fig. 18 was quite hard to read on a large desktop screen.

* Use aria-current instead of aria-selected for figure toolbar.

aria-selected implies role=tab and role=tablist, which, in turn,
required each tab item to aria-control a specific tab. We don't render
each figure immediately and switch visibility via tabbing, so it's not
possible to add the correct aria roles. In any case, since these are
anchor tags that change the URL, aria-selected may be more appropriate
anyway.

* Try out native scrollIntoView for fig. 18 boxes.

Reasons not to go with this:
- Smooth option not supported on Safari
- Not in sync with the arrow drawing, so does it actually help?
- Interferes with manual scrolling?

* Revert "Try out native scrollIntoView for fig. 18 boxes."

This reverts commit e1a9c93.

Too much effort to get to work nicely.

* Update CHANGELOG.

* Loop fig. 42 in reverse after caption appears. (#10)

* Loop fig. 42 in reverse infinitely.

* Reuse existing star animations instead of infinitely creating new ones. Fix beginAnimation() done handler not being cleaned up.

* Use passed in onLightUp instead of keeping a reference on this.

* Add jitter just before reverse animation in fig. 42.

* Reduce blur on fig. 42 thumbnail.

* Update CHANGELOG.

* Light up fig. 18 when new boxes are drawn. (#11)

* Light up fig. 18 when new boxes are drawn.

* Update CHANGELOG.

* An approach to fig. 18 where the caption also disappears during the reverse loop.

* Erratic rotation in fig. 43. Distinguish between SVG and HTML diagrams. (#12)

* Split Diagram into SVGDiagram and HTMLDiagram in prep for HTML+CSS version of fig. 43.

This also includes removing (buggy) attribute mirroring from Diagram, as
we don't use it.

* Replace SVG cube with rotating CSS keyframes cube.

* Different styling in fig. 43 for thumbnail diagram.

* Fix fig. 43 keyframes on Safari by explicitly defining rotation 0 > 90 > 180 > 270. Separate scale animation from rotation.

* Add random fuzziness to fig. 43.

* Move fuzziness handling to SchematicsFigure to include figcaption. Fine-tune fig. 43 animations.

* Add zero-case test to Duration.

* Clean up fuzzy and light up on figure change.

* Add svg and html variation classnames to diagram and use for positioning.

* Reduce repetition in positioning the diagram custom element and its children.

* Adjust fig. 43 timing.

* Attach figure behavior callbacks to diagram element after init instead of passing with draw functions.

* Implement DiagramFactory to take care of passing figureBehaviors on init.

* Update CHANGELOG.

* Add quick offset drop shadow to hiding duration and light up fig. 14 on start.

* Update CHANGELOG.

* Move some things out of main.css

* Small CSS tidy-ups.

* Fix figure toolbar breakpoints for showing active vs all links.

Also show all links on tablets if they fit.

* Disable transition and animation durations if @prefers-reduced-motion.

This doesn't include the actual figure SVG animations, only CSS.

* Revert "Disable transition and animation durations if @prefers-reduced-motion."

Will do it properly all in one go along with the figures themselves.
Also need to research acceptable levels of motion instead of disabling
everything.

This reverts commit 1066454.

* Update CHANGELOG and versions.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant