Skip to content

[Snyk] Upgrade: commander, koa-compress, ws #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade: commander, koa-compress, ws #2

wants to merge 1 commit into from

Conversation

@snyk-io
Copy link

@snyk-io snyk-io bot commented Sep 23, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Name Versions Released on

commander
from 5.1.0 to 12.1.0 | 35 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 4 months ago
on 2024-05-18
koa-compress
from 4.0.1 to 5.1.1 | 4 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | a year ago
on 2023-04-09
ws
from 7.5.10 to 8.18.0 | 30 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 3 months ago
on 2024-07-03

Release notes
Package name: commander
  • 12.1.0 - 2024-05-18

    Added

    • auto-detect special node flags node --eval and node --print when call .parse() with no arguments (#2164)

    Changed

    • prefix require of Node.js core modules with node: (#2170)
    • format source files with Prettier (#2180)
    • switch from StandardJS to directly calling ESLint for linting (#2153)
    • extend security support for previous major version of Commander (#2150)

    Removed

    • removed unimplemented Option.fullDescription from TypeScript definition (#2191)
  • 12.0.0 - 2024-02-03

    Added

    • .addHelpOption() as another way of configuring built-in help option (#2006)
    • .helpCommand() for configuring built-in help command (#2087)

    Fixed

    • Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
    • Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)

    Changed

    • Breaking: Commander 12 requires Node.js v18 or higher (#2027)
    • Breaking: throw an error if add an option with a flag which is already in use (#2055)
    • Breaking: throw an error if add a command with name or alias which is already in use (#2059)
    • Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
    • replace non-standard JSDoc of @ api private with documented @ private (#1949)
    • .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
    • refactor internal implementation of built-in help option (#2006)
    • refactor internal implementation of built-in help command (#2087)

    Deprecated

    • .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)

    Removed

    • Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)

    Migration Tips

    global program

    If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).

    // const program = require('commander');
const { program } = require('commander');

    option and command clashes

    A couple of configuration problems now throw an error, which will pick up issues in existing programs:

    • adding an option which uses the same flag as a previous option
    • adding a command which uses the same name or alias as a previous command
  • 12.0.0-1 - 2024-01-19

    Added

    • .addHelpOption() as another way of configuring built-in help option (#2006)
    • .helpCommand() for configuring built-in help command (#2087)

    Changed

    • .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
    • refactor internal implementation of built-in help option (#2006)
    • refactor internal implementation of built-in help command (#2087)

    Deprecated

    • .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)
  • 12.0.0-0 - 2023-11-11

    Fixed

    • Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
    • Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)

    Changed

    • Breaking: Commander 12 requires Node.js v18 or higher (#2027)
    • Breaking: throw an error if add an option with a flag which is already in use (#2055)
    • Breaking: throw an error if add a command with name or alias which is already in use (#2059)
    • Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
    • replace non-standard JSDoc of @ api private with documented @ private (#1949)

    Removed

    • Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)

    Migration Tips

    global program

    If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).

    // const program = require('commander');
const { program } = require('commander');

    option and command clashes

    A couple of configuration problems now throw an error, which will pick up issues in existing programs:

    • adding an option which uses the same flag as a previous option
    • adding a command which uses the same name or alias as a previous command
  • 11.1.0 - 2023-10-13

    Fixed

    • TypeScript: update OptionValueSource to allow any string, to match supported use of custom sources (#1983)
    • TypeScript: add that Command.version() can also be used as getter (#1982)
    • TypeScript: add null return type to Commands.executableDir(), for when not configured (#1965)
    • subcommands with an executable handler and only a short help flag are now handled correctly by the parent's help command (#1930)

    Added

    • registeredArguments property on Command with the array of defined Argument (like Command.options for Option) (#2010)
    • TypeScript declarations for Option properties: envVar, presetArg (#2019)
    • TypeScript declarations for Argument properties: argChoices, defaultValue, defaultValueDescription (#2019)
    • example file which shows how to configure help to display any custom usage in the list of subcommands (#1896)

    Changed

    • (developer) refactor TypeScript configs for multiple use-cases, and enable checks in JavaScript files in supporting editors (#1969)

    Deprecated

    • Command._args was private anyway, but now available as registeredArguments (#2010)
  • 11.0.0 - 2023-06-16

    Fixed

    • help command works when help option is disabled (#1864)

    Changed

    • leading and trailing spaces are now ignored by the .arguments() method (#1874)
    • refine "types" exports for ESM to follow TypeScript guidelines (#1886)
    • Breaking: Commander 11 requires Node.js v16 or higher
  • 10.0.1 - 2023-04-15

    Added

    Fixed

    • remove unused Option.optionFlags property from TypeScript definition (#1844)

    Changed

    • assume boolean option intended if caller passes string instead of hash to .implies() (#1854)
  • 10.0.0 - 2023-01-14

    Added

    • wrap command description in help (#1804)

    Changed

    • Breaking: Commander 10 requires Node.js v14 or higher
  • 9.5.0 - 2023-01-07

    Added

    • .getOptionValueSourceWithGlobals() (#1832)
    • showGlobalOptions for .configureHelp{} and Help (#1828)
  • 9.4.1 - 2022-09-30

    Fixed

    • .setOptionValue() now also clears option source (#1795)
    • TypeScript: add implied to OptionValueSource for option values set by using .implies() (#1794)
    • TypeScript : add undefined to return type of .getOptionValueSource() (#1794)

    Changed

    • additions to README
  • 9.4.0 - 2022-07-15
  • 9.3.0 - 2022-05-28
  • 9.2.0 - 2022-04-15
  • 9.1.0 - 2022-03-18
  • 9.0.0 - 2022-01-29
  • 9.0.0-1 - 2022-01-14
  • 9.0.0-0 - 2021-12-22
  • 8.3.0 - 2021-10-22
  • 8.2.0 - 2021-09-10
  • 8.1.0 - 2021-07-27
  • 8.0.0 - 2021-06-25
  • 8.0.0-2 - 2021-06-06
  • 8.0.0-1 - 2021-05-31
  • 8.0.0-0 - 2021-05-22
  • 7.2.0 - 2021-03-21
  • 7.1.0 - 2021-02-15
  • 7.0.0 - 2021-01-15
  • 7.0.0-2 - 2020-12-14
  • 7.0.0-1 - 2020-11-21
  • 7.0.0-0 - 2020-10-25
  • 6.2.1 - 2020-12-14
  • 6.2.0 - 2020-10-25
  • 6.1.0 - 2020-08-28
  • 6.0.0 - 2020-07-19
  • 6.0.0-0 - 2020-06-20
  • 5.1.0 - 2020-04-25
from commander GitHub release notes
Package name: koa-compress from koa-compress GitHub release notes
Package name: ws
  • 8.18.0 - 2024-07-03

    Features

    • Added support for Blob (#2229).
  • 8.17.1 - 2024-06-16

    Bug fixes

    • Fixed a DoS vulnerability (#2231).

    A request with a number of headers exceeding theserver.maxHeadersCount
    threshold could be used to crash a ws server.

    const http = require('http');
    const WebSocket = require('ws');

    const wss = new WebSocket.Server({ port: 0 }, function () {
    const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
    const headers = {};
    let count = 0;

    for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    <span class="pl-k">for</span> <span class="pl-kos">(</span><span class="pl-k">let</span> <span class="pl-s1">j</span> <span class="pl-c1">=</span> <span class="pl-c1">0</span><span class="pl-kos">;</span> <span class="pl-s1">j</span> <span class="pl-c1">&lt;</span> <span class="pl-s1">chars</span><span class="pl-kos">.</span><span class="pl-c1">length</span><span class="pl-kos">;</span> <span class="pl-s1">j</span><span class="pl-c1">++</span><span class="pl-kos">)</span> <span class="pl-kos">{</span>
  <span class="pl-k">const</span> <span class="pl-s1">key</span> <span class="pl-c1">=</span> <span class="pl-s1">chars</span><span class="pl-kos">[</span><span class="pl-s1">i</span><span class="pl-kos">]</span> <span class="pl-c1">+</span> <span class="pl-s1">chars</span><span class="pl-kos">[</span><span class="pl-s1">j</span><span class="pl-kos">]</span><span class="pl-kos">;</span>
  <span class="pl-s1">headers</span><span class="pl-kos">[</span><span class="pl-s1">key</span><span class="pl-kos">]</span> <span class="pl-c1">=</span> <span class="pl-s">'x'</span><span class="pl-kos">;</span>

  <span class="pl-k">if</span> <span class="pl-kos">(</span><span class="pl-c1">++</span><span class="pl-s1">count</span> <span class="pl-c1">===</span> <span class="pl-c1">2000</span><span class="pl-kos">)</span> <span class="pl-k">break</span><span class="pl-kos">;</span>
<span class="pl-kos">}</span>

    }

    headers.Connection = 'Upgrade';
    headers.Upgrade = 'websocket';
    headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
    headers['Sec-WebSocket-Version'] = '13';

    const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
    });

    request.end();
    });

    The vulnerability was reported by Ryan LaPointe in #2230.

    In vulnerable versions of ws, the issue can be mitigated in the following ways:

    1. Reduce the maximum allowed length of the request headers using the
      --max-http-header-size=size and/or the maxHeaderSize options so
      that no more headers than the server.maxHeadersCount limit can be sent.
    2. Set server.maxHeadersCount to 0 so that no limit is applied.
  • 8.17.0 - 2024-04-28

    Features

    • The WebSocket constructor now accepts the createConnection option (#2219).

    Other notable changes

    • The default value of the allowSynchronousEvents option has been changed to
      true (#2221).

    This is a breaking change in a patch release. The assumption is that the option
    is not widely used.

  • 8.16.0 - 2023-12-26

    Features

    • Added the autoPong option (01ba54e).
  • 8.15.1 - 2023-12-12

    Notable changes

    • The allowMultipleEventsPerMicrotask option has been renamed to
      allowSynchronousEvents (4ed7fe5).

    This is a breaking change in a patch release that could have been avoided with
    an alias, but the renamed option was added only 3 days ago, so hopefully it
    hasn't already been widely used.

  • 8.15.0 - 2023-12-09

    Features

    • Added the allowMultipleEventsPerMicrotask option (93e3552).
  • 8.14.2 - 2023-09-19

    Bug fixes

    • Fixed an issue that allowed errors thrown by failed assertions to be
      swallowed when running tests (7f4e1a7).
  • 8.14.1 - 2023-09-08
  • 8.14.0 - 2023-09-06
  • 8.13.0 - 2023-03-10
  • 8.12.1 - 2023-02-13
  • 8.12.0 - 2023-01-07
  • 8.11.0 - 2022-11-06
  • 8.10.0 - 2022-10-24
  • 8.9.0 - 2022-09-22
  • 8.8.1 - 2022-07-15
  • 8.8.0 - 2022-06-09
  • 8.7.0 - 2022-05-26
  • 8.6.0 - 2022-05-01
  • 8.5.0 - 2022-02-07
  • 8.4.2 - 2022-01-14
  • 8.4.1 - 2022-01-13
  • 8.4.0 - 2021-12-20
  • 8.3.0 - 2021-11-23
  • 8.2.3 - 2021-10-02
  • 8.2.2 - 2021-09-08
  • 8.2.1 - 2021-08-28
  • 8.2.0 - 2021-08-18
  • 8.1.0 - 2021-08-11
  • 8.0.0 - 2021-07-28
  • 7.5.10 - 2024-06-16

    Bug fixes

from ws GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-io
feat: upgrade multiple dependencies with Snyk
69f23ca 
Snyk has created this PR to upgrade:
  - commander from 5.1.0 to 12.1.0.
    See this package in npm: https://www.npmjs.com/package/commander
  - koa-compress from 4.0.1 to 5.1.1.
    See this package in npm: https://www.npmjs.com/package/koa-compress
  - ws from 7.5.10 to 8.18.0.
    See this package in npm: https://www.npmjs.com/package/ws

See this project in Snyk:
https://app.snyk.io/org/sherfeyinv/project/1ee3de87-4a5c-4c40-a9b5-93d890a45e7b?utm_source=github-cloud-app&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant