conductor-oss / conductor-oss/conductor
Upgrade ws package to 8.x (CVE-2024-37890)
- Dominant language
- Java
- Stars
- 32.2k
- Forks
- 1k
- Avg merge
- 2d
- Merged PRs (30d)
- 33
Description
## Security Issue
The ws package version 7.5.8 has a Denial of Service vulnerability (CVE-2024-37890).
## Current State
- **Current version**: ws@7.5.8
- **Target version**: ws@8.x (latest stable)
- **File**: ui/package.json, ui/yarn.lock
## Vulnerability Details
CVE-2024-37890 - DoS vulnerability when the number of received headers exceeds the server.maxHeadersCount threshold.
Fixed in ws@8.17.1 and backported to ws@7.5.10. We should upgrade to the latest 8.x for long-term support.
## Required Changes
1. Update ui/package.json to use ws@8.x
2. Run `yarn install` to update yarn.lock
3. Test UI build and Cypress tests
## Related
Part of #640
Closes #188
Contributor guide
Assessment
This issue has not been assessed yet.