Skip to content

Commit d94b614

Browse files
kongchen1992meta-codesync[bot]
authored andcommitted
Bump websocket-driver 0.7.4 -> 0.7.5 in vrs/website (#265)
Summary: Pull Request resolved: #265 `websocket-driver@0.7.4` in `arvr/libraries/vrs/website/yarn.lock` is flagged by [CVE-2026-54466](https://www.internalfb.com/intern/vulnerability_management/vulnerabilities/CVE-2026-54466) (CWE-130, Improper Handling of Length Parameter Inconsistency, CVSS >= 7). The fixed version is 0.7.5. The VM auto-remediator (`VMRemediatorTPLUpgrader`) already tried and failed on this asset — it fed the asset XID to the upgrader as if it were a path and bailed with `Invalid value: Project path 'arvr/libraries/vrs/website/yarn.lock#pkg:npm/websocket-driver@..' does not exist.` So this is the manual bump. `websocket-driver` is transitive-only here, pulled in twice via `webpack-dev-server`: - `sockjs@0.3.24` -> `websocket-driver@^0.7.4` - `faye-websocket@0.11.4` -> `websocket-driver@>=0.5.1` Both ranges already admit 0.7.5, so the lockfile is the only place the version actually moves. Per PiotrBrzyski's review, this also adds a `resolutions` floor in `package.json` so the fix survives a future re-resolve — see the test plan for a concrete case where the lockfile alone would silently regress. That matches what the other docusaurus sites in fbsource do for this exact package (`fbcode/whatsapp/elp/website` uses `^0.7.5`, `fbcode/buck2/website` uses `>=0.7.5 <0.8.0`), and the file already carries six `resolutions` entries of the same shape. 0.7.5 keeps the same dependency set (`http-parser-js`, `safe-buffer`, `websocket-extensions`), so no other lockfile entries move. Reviewed By: PiotrBrzyski, SeaOtocinclus Differential Revision: D116379479 fbshipit-source-id: 8a3ea5cacb6587506d2d32e7859c5b76da5c4809
1 parent d9b5489 commit d94b614

2 files changed

Lines changed: 6 additions & 5 deletions

File tree

website/package.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@
8282
"ansi-html": "0.0.8",
8383
"mermaid": "^11.12.2",
8484
"qs": "^6.14.1",
85-
"diff": "^8.0.3"
85+
"diff": "^8.0.3",
86+
"websocket-driver": "^0.7.5"
8687
}
8788
}

website/yarn.lock

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13291,10 +13291,10 @@ webpackbar@^6.0.1:
1329113291
std-env "^3.7.0"
1329213292
wrap-ansi "^7.0.0"
1329313293

13294-
websocket-driver@>=0.5.1, websocket-driver@^0.7.4:
13295-
version "0.7.4"
13296-
resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.7.4.tgz#89ad5295bbf64b480abcba31e4953aca706f5760"
13297-
integrity sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==
13294+
websocket-driver@>=0.5.1, websocket-driver@^0.7.4, websocket-driver@^0.7.5:
13295+
version "0.7.5"
13296+
resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.7.5.tgz#569d22764ab21f2de20af0e74b411e8ae5a0fa46"
13297+
integrity sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==
1329813298
dependencies:
1329913299
http-parser-js ">=0.5.1"
1330013300
safe-buffer ">=5.1.0"

0 commit comments

Comments
 (0)