Skip to content

Bump ws from 8.17.1 to 8.20.1 in /packages/vscode-graphql-execution#4306

Merged
trevor-scheer merged 3 commits into
mainfrom
dependabot/npm_and_yarn/packages/vscode-graphql-execution/ws-8.20.1
May 20, 2026
Merged

Bump ws from 8.17.1 to 8.20.1 in /packages/vscode-graphql-execution#4306
trevor-scheer merged 3 commits into
mainfrom
dependabot/npm_and_yarn/packages/vscode-graphql-execution/ws-8.20.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps ws from 8.17.1 to 8.20.1.

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

  • Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

  • Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).

8.19.0

Features

  • Added the closeTimeout option (#2308).

Bug fixes

  • Handled a forthcoming breaking change in Node.js core (19984854).

... (truncated)

Commits
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • 8439255 [dist] 8.20.0
  • d3503c1 [minor] Export the PerMessageDeflate class and header utils
  • 3ee5349 [api] Convert the isServer and maxPayload parameters to options
  • 91707b4 [doc] Add missing space
  • 8b55319 [pkg] Update eslint to version 10.0.1
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@changeset-bot

changeset-bot Bot commented May 19, 2026 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: dfac30b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
vscode-graphql-execution Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@dependabot
Bump ws from 8.17.1 to 8.20.1 in /packages/vscode-graphql-execution
1e5303f 
Bumps [ws](https://github.com/websockets/ws) from 8.17.1 to 8.20.1.
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.17.1...8.20.1)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/vscode-graphql-execution/ws-8.20.1 branch from 3bf8fe5 to 1e5303f Compare May 20, 2026 21:19
@trevor-scheer trevor-scheer enabled auto-merge (squash) May 20, 2026 21:35
@trevor-scheer trevor-scheer merged commit 7aefde8 into main May 20, 2026
12 checks passed
@trevor-scheer trevor-scheer deleted the dependabot/npm_and_yarn/packages/vscode-graphql-execution/ws-8.20.1 branch May 20, 2026 21:38
This was referenced May 20, 2026
Merged
Open
Open
Open
Open
@github-actions github-actions Bot mentioned this pull request Jun 6, 2026
Open
trevor-scheer pushed a commit that referenced this pull request Jun 6, 2026
@github-actions
Version Packages (#4315)
76ed461 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## codemirror-graphql@2.2.7

### Patch Changes

- Updated dependencies
[[`a526a10`](a526a10)]:
  - graphql-language-service@5.5.2
## @graphiql/react@0.37.6

### Patch Changes

- [#4332](#4332)
[`61d138f`](61d138f)
Thanks [@vishwakt](https://github.com/vishwakt)! - Fix image previews in
the response viewer fetching from the wrong host. Monaco splits the
hovered word on `:`, so a full URL like `https://example.com/img.png`
reaches the preview as the protocol-relative `//example.com/img.png`.
The preview stripped the leading character, turning that into the
host-relative `/example.com/img.png` and fetching it from the current
origin. The original host is now preserved.

- Updated dependencies
[[`a526a10`](a526a10)]:
  - graphql-language-service@5.5.2
## graphql-language-service@5.5.2

### Patch Changes

- [#4329](#4329)
[`a526a10`](a526a10)
Thanks [@vishwakt](https://github.com/vishwakt)! - Make the fields block
optional when parsing object, interface, input, and enum type
definitions (and their extensions) in the online parser. Per the GraphQL
spec these blocks are optional, so spec-valid SDL such as `extend type
Foo @onType` or `type Foo @onType` (directives only, no body) no longer
reports `invalidchar` during syntax highlighting.
## graphql-language-service-server@2.14.10

### Patch Changes

- [#4328](#4328)
[`d6b71ce`](d6b71ce)
Thanks [@vishwakt](https://github.com/vishwakt)! - Move
`debounce-promise` from `devDependencies` to `dependencies`. It is
imported at runtime in `MessageProcessor.ts`, so it must be a regular
dependency. Previously the package only resolved it via hoisting, which
fails under strict installs (e.g. `pnpm` v11), causing `graphql-lsp` to
crash with `Cannot find module 'debounce-promise'`.

- [#4331](#4331)
[`e1077b9`](e1077b9)
Thanks [@vishwakt](https://github.com/vishwakt)! - Import `Logger` from
`vscode-jsonrpc` instead of `vscode-languageserver`. `Logger` is defined
in `vscode-jsonrpc` (a direct dependency) and only reached
`vscode-languageserver` through a transitive re-export, which `tsgo`
failed to resolve on CI (`Module '"vscode-languageserver"' has no
exported member 'Logger'`). Importing from the package that owns the
type avoids relying on that fragile re-export chain.

- Updated dependencies
[[`a526a10`](a526a10)]:
  - graphql-language-service@5.5.2
## vscode-graphql-execution@0.3.6

### Patch Changes

- [#4306](#4306)
[`7aefde8`](7aefde8)
Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `ws` to
8.20.1 to address
[GHSA-58qx-3vcg-4xpx](GHSA-58qx-3vcg-4xpx)
(uninitialized memory disclosure in `websocket.close()`).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@trevor-scheer