conductor-oss / conductor-oss/conductor

Upgrade ws package to 8.x (CVE-2024-37890)

Open
#643 0 comments 0 reactions 1 assignee Claimed by @nthmost-orkes View on GitHub
dependencies
Dominant language
Java
Stars
32.2k
Forks
1k
Avg merge
2d
Merged PRs (30d)
33

Description

## Security Issue

The ws package version 7.5.8 has a Denial of Service vulnerability (CVE-2024-37890).

## Current State

- **Current version**: ws@7.5.8
- **Target version**: ws@8.x (latest stable)
- **File**: ui/package.json, ui/yarn.lock

## Vulnerability Details

CVE-2024-37890 - DoS vulnerability when the number of received headers exceeds the server.maxHeadersCount threshold.

Fixed in ws@8.17.1 and backported to ws@7.5.10. We should upgrade to the latest 8.x for long-term support.

## Required Changes

1. Update ui/package.json to use ws@8.x
2. Run `yarn install` to update yarn.lock
3. Test UI build and Cypress tests

## Related

Part of #640
Closes #188

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.