Commit d94b614
Bump websocket-driver 0.7.4 -> 0.7.5 in vrs/website (#265)
Summary:
Pull Request resolved: #265
`websocket-driver@0.7.4` in `arvr/libraries/vrs/website/yarn.lock` is flagged by
[CVE-2026-54466](https://www.internalfb.com/intern/vulnerability_management/vulnerabilities/CVE-2026-54466)
(CWE-130, Improper Handling of Length Parameter Inconsistency, CVSS >= 7). The fixed
version is 0.7.5.
The VM auto-remediator (`VMRemediatorTPLUpgrader`) already tried and failed on this
asset — it fed the asset XID to the upgrader as if it were a path and bailed with
`Invalid value: Project path 'arvr/libraries/vrs/website/yarn.lock#pkg:npm/websocket-driver@..' does not exist.`
So this is the manual bump.
`websocket-driver` is transitive-only here, pulled in twice via `webpack-dev-server`:
- `sockjs@0.3.24` -> `websocket-driver@^0.7.4`
- `faye-websocket@0.11.4` -> `websocket-driver@>=0.5.1`
Both ranges already admit 0.7.5, so the lockfile is the only place the version actually
moves. Per PiotrBrzyski's review, this also adds a `resolutions` floor in `package.json` so
the fix survives a future re-resolve — see the test plan for a concrete case where the
lockfile alone would silently regress. That matches what the other docusaurus sites in
fbsource do for this exact package (`fbcode/whatsapp/elp/website` uses `^0.7.5`,
`fbcode/buck2/website` uses `>=0.7.5 <0.8.0`), and the file already carries six
`resolutions` entries of the same shape.
0.7.5 keeps the same dependency set (`http-parser-js`, `safe-buffer`,
`websocket-extensions`), so no other lockfile entries move.
Reviewed By: PiotrBrzyski, SeaOtocinclus
Differential Revision: D116379479
fbshipit-source-id: 8a3ea5cacb6587506d2d32e7859c5b76da5c48091 parent d9b5489 commit d94b614
2 files changed
Lines changed: 6 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
82 | 82 | | |
83 | 83 | | |
84 | 84 | | |
85 | | - | |
| 85 | + | |
| 86 | + | |
86 | 87 | | |
87 | 88 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
13291 | 13291 | | |
13292 | 13292 | | |
13293 | 13293 | | |
13294 | | - | |
13295 | | - | |
13296 | | - | |
13297 | | - | |
| 13294 | + | |
| 13295 | + | |
| 13296 | + | |
| 13297 | + | |
13298 | 13298 | | |
13299 | 13299 | | |
13300 | 13300 | | |
| |||
0 commit comments