Skip to content

Commit

Permalink
chore: Added resolutions in package.json file to resolve CVE-2024-378… (
Browse files Browse the repository at this point in the history
#2125)

…90 CG Issue

#### Details

WS (Web Socket)'s latest version is vulnerable and unmaintained. Our
repo don't use it directly but it uses as dependency from other packages
like **puppeteer-core**. So the fix is available in latest WS version,
which we added now in our package json under resolutions.

WS repo issue link: websockets/ws#2230
WS version 8.18.0 Release notes -
https://github.com/websockets/ws/releases/tag/8.18.0


##### Motivation

This change will fix
[CVE-2024-37890](https://dev.azure.com/mseng/1ES/_componentGovernance/1010/alert/203269?typeId=286939&pipelinesTrackingFilter=0)

##### Context

<!-- Are there any parts that you've intentionally left out-of-scope for
a later PR to handle? -->

<!-- Were there any alternative approaches you considered? What
tradeoffs did you consider? -->

#### Pull request checklist
<!-- If a checklist item is not applicable to this change, write "n/a"
in the checkbox -->
- [x] Addresses an existing issue:
[CVE-2024-37890](https://dev.azure.com/mseng/1ES/_componentGovernance/1010/alert/203269?typeId=286939&pipelinesTrackingFilter=0)
- [ NA] Added relevant unit test for your changes. (`yarn test`)
- [ NA] Verified code coverage for the changes made. Check coverage
report at: `<rootDir>/test-results/unit/coverage`
- [x] Ran precheckin (`yarn precheckin`)
  • Loading branch information
v-rakeshsh committed Jul 30, 2024
1 parent cdff237 commit ef72858
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 46 deletions.
3 changes: 2 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@
"ansi-regex@^4.1.0": "^5.0.1",
"cosmiconfig@^7.0.1": "^8.1.3",
"pac-resolver": "^7.0.1",
"socks": "^2.8.3"
"socks": "^2.8.3",
"ws": "^8.17.1"
}
}
45 changes: 0 additions & 45 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -21705,51 +21705,6 @@ __metadata:
languageName: node
linkType: hard

"ws@npm:8.10.0":
version: 8.10.0
resolution: "ws@npm:8.10.0"
peerDependencies:
bufferutil: ^4.0.1
utf-8-validate: ^5.0.2
peerDependenciesMeta:
bufferutil:
optional: true
utf-8-validate:
optional: true
checksum: 3a32e15dffe633dd5ce99659793dbcf1440ea25d2da1060c88cbd22efdfb7986a6933e68aaa4b098fc3f1f7870cb386afd378a1ceaca4b31748471576d5a8b52
languageName: node
linkType: hard

"ws@npm:^7.4.6":
version: 7.5.9
resolution: "ws@npm:7.5.9"
peerDependencies:
bufferutil: ^4.0.1
utf-8-validate: ^5.0.2
peerDependenciesMeta:
bufferutil:
optional: true
utf-8-validate:
optional: true
checksum: c3c100a181b731f40b7f2fddf004aa023f79d64f489706a28bc23ff88e87f6a64b3c6651fbec3a84a53960b75159574d7a7385709847a62ddb7ad6af76f49138
languageName: node
linkType: hard

"ws@npm:^8.13.0":
version: 8.16.0
resolution: "ws@npm:8.16.0"
peerDependencies:
bufferutil: ^4.0.1
utf-8-validate: ">=5.0.2"
peerDependenciesMeta:
bufferutil:
optional: true
utf-8-validate:
optional: true
checksum: feb3eecd2bae82fa8a8beef800290ce437d8b8063bdc69712725f21aef77c49cb2ff45c6e5e7fce622248f9c7abaee506bae0a9064067ffd6935460c7357321b
languageName: node
linkType: hard

"ws@npm:^8.17.1":
version: 8.18.0
resolution: "ws@npm:8.18.0"
Expand Down

0 comments on commit ef72858

Please sign in to comment.