Bump ws and @ethersproject/providers

[dependabot]

Bumps ws and @ethersproject/providers. These dependencies needed to be updated together.
Updates ws from 7.2.3 to 7.4.6

Release notes

Sourced from ws's releases.

7.4.6

Bug fixes

• Fixed a ReDoS vulnerability (00c425ec).

A specially crafted value of the Sec-Websocket-Protocol header could be used to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

7.4.5

Bug fixes

• UTF-8 validation is now done even if utf-8-validate is not installed (23ba6b29).
• Fixed an edge case where websocket.close() and websocket.terminate() did not close the connection (67e25ff5).

7.4.4

Bug fixes

• Fixed a bug that could cause the process to crash when using the permessage-deflate extension (92774377).

7.4.3

Bug fixes

• The deflate/inflate stream is now reset instead of reinitialized when context takeover is disabled (#1840).

7.4.2

Bug fixes

... (truncated)

Commits

• f5297f7 [dist] 7.4.6
• 00c425e [security] Fix ReDoS vulnerability
• 990306d [lint] Fix prettier error
• 32e3a84 [security] Remove reference to Node Security Project
• 8c914d1 [minor] Fix nits
• fc7e27d [ci] Test on node 16
• 587c201 [ci] Do not test on node 15
• f672710 [dist] 7.4.5
• 67e25ff [fix] Fix case where abortHandshake() does not close the connection
• 23ba6b2 [fix] Make UTF-8 validation work even if utf-8-validate is not installed
• Additional commits viewable in compare view

Updates @ethersproject/providers from 5.0.9 to 5.7.2

Release notes

Sourced from @​ethersproject/providers's releases.

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-RG8QV/8Pwe52alIcSWxFpA7GbD1/mIxUAQA5PeEDh5EnTyJiWhIvYfw5RYBIz8DQ"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.1.umd.min.js">
</script>

ethers/v5.7.0 (2022-08-18 16:17)

• Update PocketProvider to newer URL format. (#2980; 10d07ca)
• Add new ENS normalization specification for wider UTF-8 support. (#42, #2376, #2754; 14bf407, fce9aaa, f274104)
• Added ACTION_REJECTED error for UI-based Signers. (d9897e0)
• Include current baseFee in feeData for easier custom fee calculation. (8314236)
• Add restrictions for new UTF-8 specification ENS names. (#42, #2376, #2754; e52fbfb)
• Expand the definition of a WebSocketLike. (#2843; 00114d7)
• Expanded type for queryFitler to allow string. (#2882; 60da870)
• Added finalized and safe blockTags. (#3091; 549168c)
• Added arbitrum-goerli to Networks and AlchemyProvider. (#3246; e72d13e)
• Add EIP-712 type exports. (#221; 7ce41cd)
• Added optimism-goerli to AlchemyProvider. (#3246; f1cb0d2)
• Updated EtherscanProvider for new CommunityResource API throttling. (6bd13c3)
• Fix old events from being emitted at the beginning of a filter. (#3069, #3094; ea2d245)
• Fixed Interface signautres missing strings as eventFragments. (#3157; c004ae5)
• Fix bug in EIP1193Bridge forwarding to the wrong method. (#3166; 17676e9)
• Use updated Web3 Secret Storage format for JSON wallets. (#3075; 6f57e8b)

... (truncated)

Changelog

Sourced from @​ethersproject/providers's changelog.

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

ethers/v5.7.0 (2022-08-18 16:17)

• Update PocketProvider to newer URL format. (#2980; 10d07ca)
• Add new ENS normalization specification for wider UTF-8 support. (#42, #2376, #2754; 14bf407, fce9aaa, f274104)
• Added ACTION_REJECTED error for UI-based Signers. (d9897e0)
• Include current baseFee in feeData for easier custom fee calculation. (8314236)
• Add restrictions for new UTF-8 specification ENS names. (#42, #2376, #2754; e52fbfb)
• Expand the definition of a WebSocketLike. (#2843; 00114d7)
• Expanded type for queryFitler to allow string. (#2882; 60da870)
• Added finalized and safe blockTags. (#3091; 549168c)
• Added arbitrum-goerli to Networks and AlchemyProvider. (#3246; e72d13e)
• Add EIP-712 type exports. (#221; 7ce41cd)
• Added optimism-goerli to AlchemyProvider. (#3246; f1cb0d2)
• Updated EtherscanProvider for new CommunityResource API throttling. (6bd13c3)
• Fix old events from being emitted at the beginning of a filter. (#3069, #3094; ea2d245)
• Fixed Interface signautres missing strings as eventFragments. (#3157; c004ae5)
• Fix bug in EIP1193Bridge forwarding to the wrong method. (#3166; 17676e9)
• Use updated Web3 Secret Storage format for JSON wallets. (#3075; 6f57e8b)
• Relaxed nameprep length requirement dropping RFC-5891 section 4.2.4. (#3161; abdf2e3)
• Switch to hash.js for ripemd160 on node as it was removed from the default crypto provider in node 17. (#3082; 450694e)
• Add optimism-kovan to EtherscanProvider. (#3135; 4d3e586)
• Forward any blockTag along in the FallbackProvider during call. (#3168; ab43e7d)
• Allow browser fetch option overrides. (#3096; c309df8)

ethers/v5.6.9 (2022-06-17 14:44)

• Removed Ankr for Ropsten default provider; the merge seems to have broke it. (3790671)
• Fix NonceManager for increment 0 and provided nonce. (#3062, #3085; 0a28679)
• Fixed topic filters for numeric types with string values. (#3013; 0078e02)

ethers/v5.6.8 (2022-05-24 11:50)

... (truncated)

Commits

• 60248f3 admin: update dist files
• 9f990c5 Added new error strings Pocket returns.
• 74e3d98 Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423)
• 8745800 admin: update dist files
• 2a3a2e1 Update testnets for third-party providers (#3320, #3323, #3340, #3358, #3423).
• 44cbc7f admin: updated dist files
• b14cb0f Fixed message signing errors that clobbered critical Error properties (#3356).
• d083522 Added Sepolia network (#3325).
• ec1b958 admin: updated dist files
• 10d07ca Update PocketProvider to newer URL format (#2980).
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.