Bump ws package to 1.1.5 due to vulnerability issues #21769

prog1dev · 2018-10-13T10:44:56Z

Update ws package from 1.1.0 to 1.1.5 due to vulnerability issues.

Here is npm audit report:

                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ ws                                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 1.1.5 <2.0.0 || >=3.3.1                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │
│               │ > react-devtools-core > ws                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/550                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

pull-bot · 2018-10-13T10:46:18Z

	Warnings
⚠️	🔒 package.json - Changes were made to package.json. This will require a manual import by a Facebook employee.
⚠️	📋 Test Plan - This PR appears to be missing a Test Plan.
⚠️	📋 Release Notes - This PR appears to be missing Release Notes.

Generated by 🚫 dangerJS

RSNara · 2018-10-15T15:00:42Z

Wow! thanks for this PR. 😁

facebook-github-bot

RSNara is landing this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

prog1dev · 2018-10-15T16:02:51Z

@RSNara Just noticed that I forgot to update yarn.lock. Also tests are red and Im not sure why

kelset · 2018-10-15T16:04:51Z

@prog1dev don't worry about AppVeyor, it's currently broken for other reasons. Thanks for the PR btw :)

facebook-github-bot · 2018-10-16T05:59:15Z

I tried to merge this pull request into the Facebook internal repo but some checks failed. To unblock yourself please check the following: Does this pull request pass all open source tests on GitHub? If not please fix those. Does the code still apply cleanly on top of GitHub master? If not can please rebase. In all other cases this means some internal test failed, for example a part of a fb app won't work with this pull request. I've added the Import Failed label to this pull request so it is easy for someone at fb to find the pull request and check what failed. If you don't see anyone comment in a few days feel free to comment mentioning one of the core contributors to the project so they get a notification.

prog1dev · 2018-10-19T10:30:24Z

@RSNara I updated yarn.lock and squished commits. Could you check this Import Failed issue?

hramos · 2018-10-22T17:42:03Z

@prog1dev your PR is fine. Anything that touches package.json and yarn.lock needs to be imported by hand, however (as @pull-bot mentioned above). React Native is hosted internally at Facebook in a monorepo with other JavaScript projects, and in this case we'll need to do some additional work in order to upgrade the ws dependency across all surfaces. We'll merge this eventually.

incarnateTheGreat · 2018-10-28T21:10:43Z

@prog1dev your PR is fine. Anything that touches package.json and yarn.lock needs to be imported by hand, however (as @pull-bot mentioned above). React Native is hosted internally at Facebook in a monorepo with other JavaScript projects, and in this case we'll need to do some additional work in order to upgrade the ws dependency across all surfaces. We'll merge this eventually.

Thank you. Looking forward to this. Unless you can recommend a workaround for the time-being?

facebook-github-bot

@cpojer has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

facebook-github-bot

@cpojer has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

cpojer · 2018-12-04T03:39:39Z

Let me ship this. Sorry for making you wait and thank you for submitting a pull request to react native :)

Summary: Update `ws` package from 1.1.0 to 1.1.5 due to vulnerability issues. Here is `npm audit` report: ``` === npm audit security report === ┌──────────────────────────────────────────────────────────────────────────────┐ │ Manual Review │ │ Some vulnerabilities require your attention to resolve │ │ │ │ Visit https://go.npm.me/audit-guide for additional guidance │ └──────────────────────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ High │ Denial of Service │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ ws │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >= 1.1.5 <2.0.0 || >=3.3.1 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │ │ │ > react-devtools-core > ws │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/550 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ``` Pull Request resolved: #21769 Reviewed By: hramos Differential Revision: D10379892 Pulled By: cpojer fbshipit-source-id: 9d03f8231a90c5f55eb95ccac029aedd45a49a2d

react-native-bot · 2018-12-04T06:25:06Z

@prog1dev merged commit 96ce6f9 into facebook:master.

Summary: Update `ws` package from 1.1.0 to 1.1.5 due to vulnerability issues. Here is `npm audit` report: ``` === npm audit security report === ┌──────────────────────────────────────────────────────────────────────────────┐ │ Manual Review │ │ Some vulnerabilities require your attention to resolve │ │ │ │ Visit https://go.npm.me/audit-guide for additional guidance │ └──────────────────────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ High │ Denial of Service │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ ws │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >= 1.1.5 <2.0.0 || >=3.3.1 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │ │ │ > react-devtools-core > ws │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/550 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ``` Pull Request resolved: #21769 Reviewed By: hramos Differential Revision: D10379892 Pulled By: cpojer fbshipit-source-id: 9d03f8231a90c5f55eb95ccac029aedd45a49a2d

Summary: Update `ws` package from 1.1.0 to 1.1.5 due to vulnerability issues. Here is `npm audit` report: ``` === npm audit security report === ┌──────────────────────────────────────────────────────────────────────────────┐ │ Manual Review │ │ Some vulnerabilities require your attention to resolve │ │ │ │ Visit https://go.npm.me/audit-guide for additional guidance │ └──────────────────────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ High │ Denial of Service │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ ws │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >= 1.1.5 <2.0.0 || >=3.3.1 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ c635d8a886cde7688a0123f573cc5b1f0430780052ba848c8fa1dc8a4c3… │ │ │ > react-devtools-core > ws │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/550 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ``` Pull Request resolved: facebook#21769 Reviewed By: hramos Differential Revision: D10379892 Pulled By: cpojer fbshipit-source-id: 9d03f8231a90c5f55eb95ccac029aedd45a49a2d

prog1dev requested a review from hramos as a code owner October 13, 2018 10:44

facebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Oct 13, 2018

prog1dev changed the title ~~Bump ws package to 1.1.5~~ Bump ws package to 1.1.5 due to vulnerability issues Oct 13, 2018

RSNara approved these changes Oct 15, 2018

View reviewed changes

facebook-github-bot added the Import Started This pull request has been imported. This does not imply the PR has been approved. label Oct 15, 2018

facebook-github-bot approved these changes Oct 15, 2018

View reviewed changes

facebook-github-bot added Import Failed and removed Import Started This pull request has been imported. This does not imply the PR has been approved. labels Oct 16, 2018

Bump ws package to 1.1.5

49bd559

hramos added 🕐PR Waiting on FB and removed Import Failed labels Oct 22, 2018

facebook-github-bot reviewed Dec 4, 2018

View reviewed changes

facebook-github-bot closed this in facebook/metro@b9e8c8a Dec 4, 2018

facebook locked as resolved and limited conversation to collaborators Dec 4, 2018

react-native-bot added the Merged This PR has been merged. label Dec 4, 2018

prog1dev deleted the update_ws_package branch December 4, 2018 10:26

hramos added Needs: Imported Diff Waiting on Meta and removed Waiting for FB labels Jan 30, 2019

hramos removed Needs: Imported Diff Waiting on Meta labels Feb 6, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump ws package to 1.1.5 due to vulnerability issues #21769

Bump ws package to 1.1.5 due to vulnerability issues #21769

prog1dev commented Oct 13, 2018

pull-bot commented Oct 13, 2018

RSNara commented Oct 15, 2018 •

edited

Loading

facebook-github-bot left a comment

prog1dev commented Oct 15, 2018

kelset commented Oct 15, 2018

facebook-github-bot commented Oct 16, 2018

prog1dev commented Oct 19, 2018

hramos commented Oct 22, 2018

incarnateTheGreat commented Oct 28, 2018

facebook-github-bot left a comment

facebook-github-bot left a comment

cpojer commented Dec 4, 2018

react-native-bot commented Dec 4, 2018

Bump ws package to 1.1.5 due to vulnerability issues #21769

Bump ws package to 1.1.5 due to vulnerability issues #21769

Conversation

prog1dev commented Oct 13, 2018

pull-bot commented Oct 13, 2018

RSNara commented Oct 15, 2018 • edited Loading

facebook-github-bot left a comment

Choose a reason for hiding this comment

prog1dev commented Oct 15, 2018

kelset commented Oct 15, 2018

facebook-github-bot commented Oct 16, 2018

prog1dev commented Oct 19, 2018

hramos commented Oct 22, 2018

incarnateTheGreat commented Oct 28, 2018

facebook-github-bot left a comment

Choose a reason for hiding this comment

facebook-github-bot left a comment

Choose a reason for hiding this comment

cpojer commented Dec 4, 2018

react-native-bot commented Dec 4, 2018

RSNara commented Oct 15, 2018 •

edited

Loading