fix: Remove CVE-2024-37890 vulnerability by updating the ws package

libraries/botframework-streaming/package.json

@@ -33,7 +33,7 @@
     "@types/node": "^10.17.27",
     "@types/ws": "^6.0.3",
     "uuid": "^8.3.2",
-    "ws": "^7.1.2"
+    "ws": "^7.5.10"
   },
   "devDependencies": {
     "chai": "^4.2.0"

package.json

@@ -63,7 +63,6 @@
     "@azure/msal-node": "^1.18.4",
     "axios": "^1.7.2",
     "tar": "6.1.9",
-    "ws": "7.4.6",
     "glob-parent": "5.1.2"
   },
   "devDependencies": {

testing/browser-functional/browser-echo-bot/package.json

@@ -16,7 +16,7 @@
     "botbuilder-dialogs": "~4.5.1",
     "botframework-directlinejs": "~0.11.2",
     "botframework-webchat": "4.5.0",
-    "core-js": "^3.0.1"
+    "core-js": "^3.1.4"
   },
   "devDependencies": {
     "@babel/cli": "^7.23.0",
@@ -26,15 +26,15 @@
     "@babel/preset-typescript": "^7.23.2",
     "@babel/runtime": "^7.23.2",
     "babel-loader": "^8.0.6",
-    "clean-webpack-plugin": "^3.0.0",
-    "copy-webpack-plugin": "^5.0.3",
-    "core-js": "^3.1.4",
+    "clean-webpack-plugin": "^4.0.0",
+    "copy-webpack-plugin": "^11.0.0",
     "css-loader": "^3.0.0",
     "regenerator-runtime": "^0.13.2",
+    "stream-browserify": "^3.0.0",
     "style-loader": "^0.23.1",
-    "webpack": "^4.35.3",
-    "webpack-cli": "^3.3.6",
-    "webpack-dev-server": "^3.7.2"
+    "webpack": "^5.92.0",
+    "webpack-cli": "^5.1.4",
+    "webpack-dev-server": "^4.15.2"
   },
   "resolutions": {
     "follow-redirects": "^1.15.4"

testing/browser-functional/browser-echo-bot/webpack.config.js

@@ -6,13 +6,13 @@
 const { join, resolve } = require('path');
 const { CleanWebpackPlugin } = require('clean-webpack-plugin');
 const CopyWebpackPlugin = require('copy-webpack-plugin');
-const { HotModuleReplacementPlugin, NamedModulesPlugin } = require('webpack');
+const webpack = require('webpack');
 
 module.exports = {
     entry: './src/app.ts',
     devtool: 'source-map',
     devServer: {
-        contentBase: './dist',
+        static: './dist',
         hot: true
     },
     mode: 'development',
@@ -34,22 +34,35 @@ module.exports = {
     },
     plugins: [
         new CleanWebpackPlugin(),
-        new NamedModulesPlugin(),
-        new HotModuleReplacementPlugin(),
-        new CopyWebpackPlugin([
-            { from: resolve(__dirname, 'index.html'), to: '' }
-        ])
+        new CopyWebpackPlugin({
+            patterns: [
+                { from: resolve(__dirname, 'index.html'), to: '' }
+            ]
+        }),
+        // Work around for Buffer is undefined:
+        // https://github.com/webpack/changelog-v5/issues/10
+        new webpack.ProvidePlugin({
+            Buffer: ['buffer', 'Buffer'],
+        }),
+        new webpack.ProvidePlugin({
+            process: 'process/browser',
+        }),
     ],
     resolve: {
-        extensions: ['.css', '.js', '.ts']
+        extensions: ['.css', '.js', '.ts'],
+        fallback: {
+            fs: false,
+            net: false,
+            tls: false,
+            vm: false,
+            path: false,
+            crypto: false,
+            stream: require.resolve("stream-browserify"),
+            buffer: require.resolve("buffer")
+        }
     },
     output: {
         filename: 'app.js',
         path: resolve(__dirname, 'dist')
-    },
-    node: {
-        fs: 'empty',
-        net: 'empty',
-        tls: 'empty'
     }
 };