Update dependency ws to v7.4.6 - autoclosed

[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
ws	dependencies	minor	7.2.1 -> 7.4.6

By merging this PR, the issue #9 will be automatically resolved and closed:

Severity	CVSS Score	CVE
High	7.5	CVE-2024-37890
Medium	5.3	CVE-2021-32640

---

Release Notes

websockets/ws (ws)

v7.4.6

Compare Source

Bug fixes

• Fixed a ReDoS vulnerability (00c425e).

A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.

v7.4.5

Compare Source

Bug fixes

• UTF-8 validation is now done even if utf-8-validate is not installed
  (23ba6b2).
• Fixed an edge case where websocket.close() and websocket.terminate() did
  not close the connection (67e25ff).

v7.4.4

Compare Source

Bug fixes

• Fixed a bug that could cause the process to crash when using the
  permessage-deflate extension (9277437).

v7.4.3

Compare Source

Bug fixes

• The deflate/inflate stream is now reset instead of reinitialized when context
  takeover is disabled (#​1840).

v7.4.2

Compare Source

Bug fixes

• Silenced a deprecation warning (a2c0d44).

v7.4.1

Compare Source

Bug fixes

• Added a workaround for a double 'error' event bug in Node.js < 13 which
  caused an uncaught error during the WebSocket handshake (38d6ab3).

v7.4.0

Compare Source

Features

• The callback of WebSocketServer.prototype.handleUpgrade() now takes the
  client HTTP GET request as second argument (7d39f19).

Bug fixes

• Read-only properties are now read-only (eabed8f).
• The CONNECTING, OPEN, CLOSING, CLOSED, binaryType, bufferedAmount,
  extensions, onclose, onerror, onmessage, onopen, protocol,
  readyState, and url properties are now enumerable (2069e68).

v7.3.1

Compare Source

Bug fixes

• Improved websocket.bufferedAmount accuracy (e1349c0, a162942).

v7.3.0

Compare Source

Features

• WebSocket.prototype.addEventListener() now supports the once option (#​1754).

v7.2.5

Compare Source

Bug fixes

• Fixed compatibility with Node.js master (651d662).

v7.2.3

Compare Source

Bug fixes

• WebSocket#{p{i,o}ng,close}() now thow an error if the data to send is too
  large to fit in a control frame (e54f08d).

v7.2.2

Compare Source

Bug fixes

• Fixed an issue where calling webSocketStream.end() could cause the process
  to crash (9535702).
• The connection is now closed if a non-masked frame is received on the server
  or a masked frame is received on the client (#​1681).
• The status code 1014 is now allowed to be used (#​1682).

---

• If you want to rebase/retry this PR, check this box