chore(deps): bump ws from 8.16.0 to 8.20.1 by dependabot[bot] · Pull Request #6184 · getsentry/sentry-react-native

dependabot · 2026-05-19T00:16:18Z

Bumps ws from 8.16.0 to 8.20.1.

Release notes

8.20.1

Bug fixes

Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.
import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});
The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).

8.19.0

Features

Added the closeTimeout option (#2308).

Bug fixes

Handled a forthcoming breaking change in Node.js core (19984854).

... (truncated)

Commits

5d9b316 [dist] 8.20.1
c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
ce2a3d6 [ci] Test on node 26
58e45b8 [ci] Do not test on node 25
5f26c24 [ci] Run the lint step on node 24
8439255 [dist] 8.20.0
d3503c1 [minor] Export the PerMessageDeflate class and header utils
3ee5349 [api] Convert the isServer and maxPayload parameters to options
91707b4 [doc] Add missing space
8b55319 [pkg] Update eslint to version 10.0.1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [ws](https://github.com/websockets/ws) from 8.16.0 to 8.20.1. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.16.0...8.20.1) --- updated-dependencies: - dependency-name: ws dependency-version: 8.20.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-19T00:16:40Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

chore(deps): bump ws from 8.16.0 to 8.20.1 by dependabot[bot] in #6184

fix(ios): Use conditional import for SentrySwizzle.h by antonis in #6186
fix(ios): use framework-style import for SentrySwizzle.h by alwx in #6181
chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by dependabot in #6178
chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by dependabot in #6176
chore(deps): bump getsentry/craft from 2.26.3 to 2.26.5 by dependabot in #6179
chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.26.3 to 2.26.5 by dependabot in #6177
fix(core): Resolve expo CLI directly instead of using npx in sourcemap upload by antonis in #6155
feat(core): Surface textComponentNames option in Metro config by antonis in #6169
chore(deps): update Sentry Android Gradle Plugin to v6.7.0 by github-actions in #6153
Filter ExceptionsManager.reportException duplicates in app-start init by alwx in #6145
chore(deps): update JavaScript SDK to v10.53.1 by github-actions in #6139
feat(core): Enable autoInjectSentryLabel by default in Metro config by antonis in #6141
feat(core): Respect Mask boundaries when reading sentry-label by antonis in #6142
fix(android): Handle boolean values in JSON options converter by antonis in #6130
Multi-instance <TimeToInitialDisplay> / <TimeToFullDisplay> coordination; a multi-signal TTID/TTFD system by alwx in #6090
chore(deps): update Bundler Plugins to v5.3.0 by github-actions in #6138
chore: Merge 8.11.1 back to main by antonis in #6135
chore: Update warning regarding iOS crash in sentry-cocoa 9.12.0 by antonis in #6136
chore(deps): update CLI to v3.4.2 by github-actions in #6129
chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.26.2 to 2.26.3 by dependabot in #6126
chore(deps): bump getsentry/craft from 2.26.2 to 2.26.3 by dependabot in #6127
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by dependabot in #6128
feat(core): Extract text from children of touched components for breadcrumb labels by antonis in #6106

Plus 8 more

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-05-19T00:16:40Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

chore(deps): bump ws from 8.16.0 to 8.20.1 by dependabot[bot] in #6184

fix(ios): use framework-style import for SentrySwizzle.h by alwx in #6181
chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by dependabot in #6178
chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by dependabot in #6176
chore(deps): bump getsentry/craft from 2.26.3 to 2.26.5 by dependabot in #6179
chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.26.3 to 2.26.5 by dependabot in #6177
fix(core): Resolve expo CLI directly instead of using npx in sourcemap upload by antonis in #6155
feat(core): Surface textComponentNames option in Metro config by antonis in #6169
chore(deps): update Sentry Android Gradle Plugin to v6.7.0 by github-actions in #6153
Filter ExceptionsManager.reportException duplicates in app-start init by alwx in #6145
chore(deps): update JavaScript SDK to v10.53.1 by github-actions in #6139
feat(core): Enable autoInjectSentryLabel by default in Metro config by antonis in #6141
feat(core): Respect Mask boundaries when reading sentry-label by antonis in #6142
fix(android): Handle boolean values in JSON options converter by antonis in #6130
Multi-instance <TimeToInitialDisplay> / <TimeToFullDisplay> coordination; a multi-signal TTID/TTFD system by alwx in #6090
chore(deps): update Bundler Plugins to v5.3.0 by github-actions in #6138
chore: Merge 8.11.1 back to main by antonis in #6135
chore: Update warning regarding iOS crash in sentry-cocoa 9.12.0 by antonis in #6136
chore(deps): update CLI to v3.4.2 by github-actions in #6129
chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.26.2 to 2.26.3 by dependabot in #6126
chore(deps): bump getsentry/craft from 2.26.2 to 2.26.3 by dependabot in #6127
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by dependabot in #6128
feat(core): Extract text from children of touched components for breadcrumb labels by antonis in #6106
chore(deps): bump @babel/plugin-transform-modules-systemjs from 7.25.0 to 7.29.4 by dependabot in #6124

Plus 7 more

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-05-19T08:53:44Z

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 93448b6

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026

dependabot Bot requested review from alwx, antonis and lucas-zimerman as code owners May 19, 2026 00:16

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026

Merge branch 'main' into dependabot/npm_and_yarn/ws-8.20.1

93448b6

antonis enabled auto-merge (squash) May 19, 2026 08:53

antonis approved these changes May 19, 2026

View reviewed changes

antonis merged commit 77ecdcb into main May 19, 2026
47 of 61 checks passed

antonis deleted the dependabot/npm_and_yarn/ws-8.20.1 branch May 19, 2026 09:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump ws from 8.16.0 to 8.20.1#6184

chore(deps): bump ws from 8.16.0 to 8.20.1#6184
antonis merged 2 commits into
mainfrom
dependabot/npm_and_yarn/ws-8.20.1

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 19, 2026

8.20.1

Bug fixes

8.20.0

Features

8.19.0

Features

Bug fixes

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

Uh oh!

github-actions Bot commented May 19, 2026

Semver Impact of This PR

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented May 19, 2026 •

edited

Loading