dependabot[bot] opened a new pull request, #11471: URL: https://github.com/apache/nifi/pull/11471
Bumps [ws](https://github.com/websockets/ws), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together. Updates `ws` from 8.17.1 to 8.21.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases";>ws's releases</a>.</em></p> <blockquote> <h2>8.21.1</h2> <h1>Bug fixes</h1> <ul> <li>Empty fragments are now counted toward the limit (a2f4e7c0).</li> <li>The default values of the <code>maxBufferedChunks</code> and <code>maxFragments</code> options have been reduced (f197ac65).</li> </ul> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/ae1de54330cef77e487548890fabfeb9aae1d83d";><code>ae1de54</code></a> [dist] 8.21.1</li> <li><a href="https://github.com/websockets/ws/commit/8e9511b86b3fc6deebbd97dd9af7c9056deea8d1";><code>8e9511b</code></a> [ci] Trust Coveralls Homebrew tap</li> <li><a href="https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d";><code>f197ac6</code></a> [fix] Lower default values of <code>maxBufferedChunks</code> and <code>maxFragments</code></li> <li><a href="https://github.com/websockets/ws/commit/8df8265c2f63fd44af3193a98e23cf38888cd991";><code>8df8265</code></a> [ci] Update actions/checkout action to v7</li> <li><a href="https://github.com/websockets/ws/commit/a2f4e7c046c2112bbce6fef39a083dac77d6f0d2";><code>a2f4e7c</code></a> [fix] Count empty fragments toward the limit (<a href="https://redirect.github.com/websockets/ws/issues/2329";>#2329</a>)</li> <li><a href="https://github.com/websockets/ws/commit/e79f912cb3f492ae04c28feb9459a209e186b0ad";><code>e79f912</code></a> [pkg] Approve install scripts for bufferutil and utf-8-validate</li> <li><a href="https://github.com/websockets/ws/commit/4ea355d6d3069394994f82ca1b6d38c32ba208fb";><code>4ea355d</code></a> [doc] Document 32-bit signed integer coercion for option values</li> <li><a href="https://github.com/websockets/ws/commit/2120f4c8c625a76316792680a231496e1b615252";><code>2120f4c</code></a> [example] Remove uuid dependency</li> <li><a href="https://github.com/websockets/ws/commit/4c534a6b8a5224a563af116e85c6ced7d4ca60cf";><code>4c534a6</code></a> [security] Add latest vulnerability to SECURITY.md</li> <li><a href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94";><code>bca91ad</code></a> [dist] 8.21.0</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.17.1...8.21.1";>compare view</a></li> </ul> </details> <br /> Updates `engine.io` from 6.6.2 to 6.6.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases";>engine.io's releases</a>.</em></p> <blockquote> <h2>[email protected]</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p";>CVE-2026-48779</a>.</p> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.21.0";><code>ws@~8.21.0</code></a> (<a href="https://github.com/websockets/ws/compare/8.20.1...8.21.0";>diff</a>)</li> </ul> <h2>[email protected]</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx";>CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1";><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1";>diff</a>)</li> </ul> <h2>[email protected]</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx";>CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Bug Fixes</h3> <ul> <li>clean up resources upon WebTransport handshake failure (<a href="https://github.com/socketio/socket.io/commit/f86b95fdba6dd260b3d2f57e69537aeb8de904bb";>f86b95f</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1";><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1";>diff</a>)</li> </ul> <h2>[email protected]</h2> <h3>Bug Fixes</h3> <ul> <li>close HTTP requests with invalid content type (<a href="https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671";>fc11285</a>)</li> <li>handle invalid packets when upgrading to WebTransport (<a href="https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c";>1fa1f46</a>)</li> <li>prevent WebTransport connections when a middleware is registered (<a href="https://github.com/socketio/socket.io/commit/d1f5aa93722a7f1ed729b96f771daf92a3dfdaf7";>d1f5aa9</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.18.3";><code>ws@~8.18.3</code></a> (no change)</li> </ul> <h2>[email protected]</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da";><code>9dbec81</code></a> chore(release): [email protected]</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf";><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1";><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604";><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508";>#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49";><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9";><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70";><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0";><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li><a href="https://github.com/socketio/socket.io/commit/190572d2459681a757e23e6010939ac5e53fdfcf";><code>190572d</code></a> refactor(eio-client): remove XMLHttpRequest from the definition file</li> <li><a href="https://github.com/socketio/socket.io/commit/fad463c54d04799e1592361b0fd8344a5fab960d";><code>fad463c</code></a> docs(examples): fix duplicate self messages (<a href="https://redirect.github.com/socketio/socket.io/issues/5341";>#5341</a>)</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/[email protected]@6.6.9";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for engine.io since your current version.</p> </details> <br /> Updates `socket.io-adapter` from 2.5.5 to 2.5.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases";>socket.io-adapter's releases</a>.</em></p> <blockquote> <h2>[email protected]</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p";>CVE-2026-48779</a>.</p> <h2>[email protected]</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx";>CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Bug Fixes</h3> <ul> <li>do not skip local broadcast when publishAndReturnOffset throws (<a href="https://redirect.github.com/socketio/socket.IO/issues/5457";>#5457</a>) (<a href="https://github.com/socketio/socket.io/commit/f6301588ca65de270ecfe22da9023d7ec79ba23a";>f630158</a>)</li> </ul> <h2>[email protected]</h2> <p>This release contains a bump of:</p> <ul> <li><code>ws</code> from <code>~8.17.1</code> to <code>~8.18.3</code></li> <li><code>debug</code> from <code>~4.3.1</code> to <code>~4.4.1</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/ac83bfad2eb8bdd1ceddd46ddb1b4ee692d7262d";><code>ac83bfa</code></a> chore(release): [email protected]</li> <li><a href="https://github.com/socketio/socket.io/commit/22cc483786a5084b8c6d8595e46f7d99d1587fea";><code>22cc483</code></a> chore(release): [email protected]</li> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da";><code>9dbec81</code></a> chore(release): [email protected]</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf";><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1";><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604";><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508";>#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49";><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9";><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70";><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0";><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/[email protected]@2.5.8";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for socket.io-adapter since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/nifi/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
