posibility of a 2.1.2 release with less strict websocket-stream version dependency

[bestrivens001]

Hi, @RangerMauve, I'd like to report a vulnerability introduced by package [email protected]:

Issue Description

I noticed that a vulnerability is introduced in [email protected]:
Vulnerability CVE-2021-32640 affects package ws (versions:<5.2.3,>=6.0.0 <6.2.2,>=7.0.0 <7.4.6): https://snyk.io/vuln/SNYK-JS-WS-1296835
The above vulnerable package is referenced by [email protected] via:
[email protected] ➔ [email protected] ➔ [email protected]

Since [email protected] is referenced by 34 downstream projects (e.g., ssb-dht-invite 2.0.0 (latest version), multiserver-dht 5.0.0 (latest version), ssb-browser-core 11.1.0 (latest version), cabal 13.4.1 (latest version), dat-sdk 2.8.1 (latest version)), the vulnerability CVE-2021-32640 can be propagated into these downstream projects and expose security threats to them via the following package dependency paths:
(1)@telios/[email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected]
(2)[email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected]
......

If [email protected].* removes the vulnerable package from the above version, then its fixed version can help downstream users decrease their pain.

Given the large number of downstream users, could you help update your package to remove the vulnerability from [email protected] ?

Fixing suggestions

In [email protected], maybe you can kindly try to perform the following upgrade :
websocket-stream ^5.5.2 ➔ ~5.2.0;

Note:
[email protected](>=5.2.0 <5.4.0) directly depends on [email protected] which has fixed the vulnerability CVE-2021-32640.

Thank you for your attention to this issue and welcome to share other ways to resolve the issue.
^_^

[RangerMauve]

Thank you for the report! I think there's only a couple of hyperswarm-web-proxy-ws servers out there right now, so it wouldn't be hard to DOS them with this vuln. :P

From what I can tell it's not super likely that hyperswarm-web will be targeted since not many actually make use of this module yet, but it's probably good to fix it sooner than later.

Would getting websocket-stream and upgrading to their latest version also make sense here? max-mapper/websocket-stream#162

I know some of the folks that maintain that module so maybe I could get a PR pushed through quickly enough.