[Snyk] Upgrade ws from 7.2.5 to 7.5.9

[snyk-bot]

Snyk has created this PR to upgrade ws from 7.2.5 to 7.5.9.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 19 versions ahead of your current version.
• The recommended version was released a year ago, on 2022-07-15.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: ws

• 7.5.9 - 2022-07-15
  

  Bug fixes

  • Backported bc8bd34 to the 7.x release line (0435e6e).
• 7.5.8 - 2022-05-26
• 7.5.7 - 2022-02-07
• 7.5.6 - 2021-11-23
• 7.5.5 - 2021-09-08
• 7.5.4 - 2021-08-28
• 7.5.3 - 2021-07-10
• 7.5.2 - 2021-07-04
• 7.5.1 - 2021-06-29
• 7.5.0 - 2021-06-16
• 7.4.6 - 2021-05-25
• 7.4.5 - 2021-04-18
• 7.4.4 - 2021-03-06
• 7.4.3 - 2021-02-02
• 7.4.2 - 2020-12-29
• 7.4.1 - 2020-12-04
• 7.4.0 - 2020-11-08
• 7.3.1 - 2020-07-05
• 7.3.0 - 2020-05-10
• 7.2.5 - 2020-04-25

from ws GitHub release notes

Commit messages

Package name: ws

• 8a78f87 [dist] 7.5.9
• 0435e6e [security] Fix same host check for ws+unix: redirects
• 4271f07 [dist] 7.5.8
• dc1781b [security] Drop sensitive headers when following insecure redirects
• 2758ed3 [fix] Abort the handshake if the Upgrade header is invalid
• a370613 [dist] 7.5.7
• 1f72e2e [security] Drop sensitive headers when following redirects (#2013)
• 8ecd890 [dist] 7.5.6
• 22a26af [fix] Resume the socket in the `CLOSING` state
• 73dec34 [fix] Do not throw if the redirect URL is invalid
• 2d968a6 [dist] 7.5.5
• ab5fcd6 [doc] Change label text to CI
• aa21e70 [ci] Use Github Actions for Windows x86 testing
• e519810 [pkg] Update eslint-plugin-prettier to version 4.0.0
• 0e274ac [minor] Skip unnecessary operations if the socket is already closed
• 075752d [dist] 7.5.4
• 2799793 [fix] Resume the socket in the next tick
• 76087fb [fix] Do not rely on undocumented behavior
• 4c1849a [dist] 7.5.3
• 772236a [fix] Abort the handshake if the server is closing or closed
• 5a58730 [fix] Emit the `'close'` event after the server is closed
• ea63b29 [minor] Fix typo
• 66e58d2 [fix] Make the `{noS,s}erver`, and `port` options mutually exclusive
• ecb9d9e [minor] Improve JSDoc-inferred types (#1912)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs