github-starred/feeddeck
2
0
Fork 0
mirror of https://github.com/feeddeck/feeddeck.git synced 2026-07-10 19:43:13 -05:00
Code Issues 257 Packages Projects Releases 8 Wiki Activity

[PR #336] chore(deps): bump ws, engine.io and socket.io-adapter in /supabase/email-templates #6862

New Issue
Open
opened 2026-06-21 20:57:02 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-06-21 20:57:02 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/feeddeck/feeddeck/pull/336
Author: @dependabot[bot]
Created: 6/21/2026
Status: 🔄 Open

Base: main ← Head: dependabot/npm_and_yarn/supabase/email-templates/multi-5f1280885e

📝 Commits (1)

  • f8ba37f chore(deps): bump ws, engine.io and socket.io-adapter

📊 Changes

1 file changed (+24 additions, -49 deletions)

View changed files

📝 supabase/email-templates/package-lock.json (+24 -49)

📄 Description

Bumps ws, engine.io and socket.io-adapter. These dependencies needed to be updated together.
Updates ws from 8.17.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});


ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});


ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});


wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits
  • bca91ad [dist] 8.21.0
  • 2b2abd4 [security] Limit retained message parts
  • 78eabe2 [security] Add latest vulnerability to SECURITY.md
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • 8439255 [dist] 8.20.0
  • d3503c1 [minor] Export the PerMessageDeflate class and header utils
  • Additional commits viewable in compare view

Updates engine.io from 6.6.4 to 6.6.9

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

Dependencies

engine.io-client@6.6.5

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Dependencies

engine.io@6.6.8

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Bug Fixes

  • clean up resources upon WebTransport handshake failure (f86b95f)

Dependencies

engine.io@6.6.7

Bug Fixes

  • close HTTP requests with invalid content type (fc11285)
  • handle invalid packets when upgrading to WebTransport (1fa1f46)
  • prevent WebTransport connections when a middleware is registered (d1f5aa9)

Dependencies

engine.io@6.6.6

... (truncated)

Commits
  • 9dbec81 chore(release): engine.io@6.6.9
  • 3ad4e1f docs: improve example with PM2
  • 0e5afee docs: add example with PM2
  • eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
  • c17890c docs: add documentation about WebTransport
  • 20df6ae docs(examples): add client-side load balancing example
  • 16d1923 ci(publish): enable staged publishing
  • ad48a9b docs(examples): add example with HTTP/2
  • 190572d refactor(eio-client): remove XMLHttpRequest from the definition file
  • fad463c docs(examples): fix duplicate self messages (#5341)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.


Updates socket.io-adapter from 2.5.5 to 2.5.8

Release notes

Sourced from socket.io-adapter's releases.

socket.io-adapter@2.5.8

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

socket.io-adapter@2.5.7

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Bug Fixes

  • do not skip local broadcast when publishAndReturnOffset throws (#5457) (f630158)

socket.io-adapter@2.5.6

This release contains a bump of:

  • ws from ~8.17.1 to ~8.18.3
  • debug from ~4.3.1 to ~4.4.1
Commits
  • ac83bfa chore(release): socket.io-adapter@2.5.8
  • 22cc483 chore(release): engine.io-client@6.6.6
  • 9dbec81 chore(release): engine.io@6.6.9
  • 3ad4e1f docs: improve example with PM2
  • 0e5afee docs: add example with PM2
  • eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
  • c17890c docs: add documentation about WebTransport
  • 20df6ae docs(examples): add client-side load balancing example
  • 16d1923 ci(publish): enable staged publishing
  • ad48a9b docs(examples): add example with HTTP/2
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io-adapter since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/feeddeck/feeddeck/pull/336 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 6/21/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/supabase/email-templates/multi-5f1280885e` --- ### 📝 Commits (1) - [`f8ba37f`](https://github.com/feeddeck/feeddeck/commit/f8ba37fd18df2d099b26c53767da17bd5b0fcf74) chore(deps): bump ws, engine.io and socket.io-adapter ### 📊 Changes **1 file changed** (+24 additions, -49 deletions) <details> <summary>View changed files</summary> 📝 `supabase/email-templates/package-lock.json` (+24 -49) </details> ### 📄 Description Bumps [ws](https://github.com/websockets/ws), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together. Updates `ws` from 8.17.1 to 8.21.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p> <p>The vulnerability was responsibly disclosed and fixed by <a href="https://github.com/Nadav0077">Nadav Magier</a>.</p> <p>In vulnerable versions, the issue can be mitigated by lowering the value of the <code>maxPayload</code> option if possible.</p> <h2>8.20.1</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a> [dist] 8.21.0</li> <li><a href="https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a"><code>2b2abd4</code></a> [security] Limit retained message parts</li> <li><a href="https://github.com/websockets/ws/commit/78eabe2a6677b231bf9c82601bde86ff91639490"><code>78eabe2</code></a> [security] Add latest vulnerability to SECURITY.md</li> <li><a href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a> [dist] 8.20.1</li> <li><a href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a> [security] Fix uninitialized memory disclosure in <code>websocket.close()</code></li> <li><a href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a> [ci] Test on node 26</li> <li><a href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a> [ci] Do not test on node 25</li> <li><a href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a> [ci] Run the lint step on node 24</li> <li><a href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a> [dist] 8.20.0</li> <li><a href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a> [minor] Export the <code>PerMessageDeflate</code> class and header utils</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.17.1...8.21.0">compare view</a></li> </ul> </details> <br /> Updates `engine.io` from 6.6.4 to 6.6.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">engine.io's releases</a>.</em></p> <blockquote> <h2>engine.io@6.6.9</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.21.0"><code>ws@~8.21.0</code></a> (<a href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">diff</a>)</li> </ul> <h2>engine.io-client@6.6.5</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1"><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">diff</a>)</li> </ul> <h2>engine.io@6.6.8</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Bug Fixes</h3> <ul> <li>clean up resources upon WebTransport handshake failure (<a href="https://github.com/socketio/socket/commit/f86b95fdba6dd260b3d2f57e69537aeb8de904bb">f86b95f</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1"><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">diff</a>)</li> </ul> <h2>engine.io@6.6.7</h2> <h3>Bug Fixes</h3> <ul> <li>close HTTP requests with invalid content type (<a href="https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671">fc11285</a>)</li> <li>handle invalid packets when upgrading to WebTransport (<a href="https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c">1fa1f46</a>)</li> <li>prevent WebTransport connections when a middleware is registered (<a href="https://github.com/socketio/socket.io/commit/d1f5aa93722a7f1ed729b96f771daf92a3dfdaf7">d1f5aa9</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.18.3"><code>ws@~8.18.3</code></a> (no change)</li> </ul> <h2>engine.io@6.6.6</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da"><code>9dbec81</code></a> chore(release): engine.io@6.6.9</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf"><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1"><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604"><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508">#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49"><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9"><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70"><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0"><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li><a href="https://github.com/socketio/socket.io/commit/190572d2459681a757e23e6010939ac5e53fdfcf"><code>190572d</code></a> refactor(eio-client): remove XMLHttpRequest from the definition file</li> <li><a href="https://github.com/socketio/socket.io/commit/fad463c54d04799e1592361b0fd8344a5fab960d"><code>fad463c</code></a> docs(examples): fix duplicate self messages (<a href="https://redirect.github.com/socketio/socket.io/issues/5341">#5341</a>)</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/engine.io@6.6.4...engine.io@6.6.9">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for engine.io since your current version.</p> </details> <br /> Updates `socket.io-adapter` from 2.5.5 to 2.5.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">socket.io-adapter's releases</a>.</em></p> <blockquote> <h2>socket.io-adapter@2.5.8</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h2>socket.io-adapter@2.5.7</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Bug Fixes</h3> <ul> <li>do not skip local broadcast when publishAndReturnOffset throws (<a href="https://redirect.github.com/socketio/socket/issues/5457">#5457</a>) (<a href="https://github.com/socketio/socket/commit/f6301588ca65de270ecfe22da9023d7ec79ba23a">f630158</a>)</li> </ul> <h2>socket.io-adapter@2.5.6</h2> <p>This release contains a bump of:</p> <ul> <li><code>ws</code> from <code>~8.17.1</code> to <code>~8.18.3</code></li> <li><code>debug</code> from <code>~4.3.1</code> to <code>~4.4.1</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/ac83bfad2eb8bdd1ceddd46ddb1b4ee692d7262d"><code>ac83bfa</code></a> chore(release): socket.io-adapter@2.5.8</li> <li><a href="https://github.com/socketio/socket.io/commit/22cc483786a5084b8c6d8595e46f7d99d1587fea"><code>22cc483</code></a> chore(release): engine.io-client@6.6.6</li> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da"><code>9dbec81</code></a> chore(release): engine.io@6.6.9</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf"><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1"><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604"><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508">#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49"><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9"><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70"><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0"><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/socket.io-adapter@2.5.5...socket.io-adapter@2.5.8">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for socket.io-adapter since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/feeddeck/feeddeck/network/alerts). </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-06-21 20:57:02 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/feeddeck#6862
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?