Update ws to 8.17.1 to mitigate CVE-2024-37890

[Plsr]

We were notified by dependabot this morning about CVE-2024-37890 that was introduced to our project by a peer-dependency on ws by jsdom.

This issue was fixed in version 8.17.1 of ws, so this PR introduces this update.

This release of ws addresses only this fix (see release notes)

[gazpachu]

Merge please 🙏

[kevinschaul]

You'll want to update the ws version in package.json too, right? https://github.com/jsdom/jsdom/blob/main/package.json#L42

[Plsr]

@kevinschaul good point, updated package.json as well

@ibakirov not sure if it's helpful to have two PRs open for this now

[ibakirov]

@Plsr ok, i canceled my request

[domenic]

Since jsdom uses ^8.17.0, 8.17.1 is automatically installed by all compliant package managers, so this is not necessary.

[Plsr]

@domenic True, I missed that tbh. Thought it would be nice to exclude the version with a known vulnerability explicitly anyways.

Thanks for taking the time to look at this and your work on jsdom, have a great day!

[ibakirov]

@domenic I would argue and propose ^8.17.1 to be clearly defined.

[am]

Since jsdom uses ^8.17.0, 8.17.1 is automatically installed by all compliant package managers, so this is not necessary.

Isn't package-lock.json definition preventing that from happening?

[jhoermann]

With npm update it'll automatically update ws in your package lock file as mentioned in #3734 (comment).

[bendeutz]

I am a bit confused why now both PRs are closed (and not merged)? Sorry if i missed something.

[MarkBerube]

@bendeutz other PR was closed due to dup. PR. This one was closed because the dep definition in package.json includes 8.17.1 in the package.json already technically:

"ws": "^8.17.0",

The problem I still face though is that the lack of package lock updates makes many dependency/security managers like dependabot scream because jsdom's package lock is still set at 8.17.0. npm update will not fix that, only modding the lock will.

could this please be reopened @domenic ?

[domenic]

Nope, if there are tools that don't understand the ^ syntax, we're not going to work around them in jsdom.