Sourced from ws's releases.

8.20.1

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

• Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).

8.19.0

Features

• Added the closeTimeout option (#2308).

Bug fixes

• Handled a forthcoming breaking change in Node.js core (19984854).

• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• 3ee5349 [api] Convert the isServer and maxPayload parameters to options
• 91707b4 [doc] Add missing space
• 8b55319 [pkg] Update eslint to version 10.0.1
• Additional commits viewable in compare view

Sourced from viem's releases.

[email protected]

Minor Changes

• #4689 fb032ee43ace76bbe72170c1b3ed48880033b763 Thanks @​jxom! - viem/tempo: Added admin access key actions, and an accessKey.verifyHash action.

• #4688 19a26084eb448632883602b401516e17cc9f7e0d Thanks @​jxom! - viem/tempo: Added access-key witness actions.

• #4683 42d54ef89a85aa9ef8658a89b67271331b5a31d4 Thanks @​jxom! - viem/tempo: Updated precompile ABIs and added the receivePolicyGuard and signatureVerifier precompile addresses to Addresses, plus the t4/t5/t6 hardforks to Hardfork.

• #4687 0e826149964a6e76d8079b368ca6f034bde7f482 Thanks @​jxom! - viem/tempo: Added receivePolicy actions.

[email protected]

Patch Changes

• #4675 cc15e56ae47e03d2ec8fe9b0e443b4e52b7c350a Thanks @​deodad! - Fixed access key metadata reads incorrectly using the client account.

[email protected]

Patch Changes

• #4668 672a7ef72cd7fb9b9330d5c90979729e6b96cbbc Thanks @​deodad! - viem/tempo: Fixed signVoucher to raw sign channel vouchers with access key accounts.

• #4672 c582dad966c136488b9f36c01f0f3986ff98e407 Thanks @​deodad! - Added a Tempo key authorization manager that can be used by prepareTransactionRequest to attach pending key authorizations.

[email protected]

Minor Changes

• #4663 752712f1d2358715e9d63bd754f80c90a8d02e91 Thanks @​jxom! - viem/tempo: Added Actions.channel actions for reading and mutating TIP-20 channel reserve state.

• #4597 d346038e71f31cb1c82fc94bb49c4ac553a23717 Thanks @​wwared! - viem/op-stack: Added OP Stack super-root dispute game support for withdrawal prove flows.

• #4661 9713c7562eac9fd328e6cc1be7388bc1659a9c27 Thanks @​jxom! - Updated generated Tempo precompile ABIs from latest Tempo main and added logoURI to TIP-20 metadata and token creation.

• #4653 a29cf5eef5809b50bbb7931f35331203c32d7692 Thanks @​islishude! - Added support for eth_getBlockReceipts.

Patch Changes

• #4650 73b8b89c0369597bf4df781b021130f544ebe6b0 Thanks @​deodad! - Exported ExtractFormattedTransactionRequest.

• #4664 c3fda73603695bc68336f6e22f6475ba6ed0cdc7 Thanks @​jxom! - Handled eth_createAccessList responses that include an error field.

• #4660 c5cc58ebbc027029022f09eba54ed2e789b8b2b1 Thanks @​struong! - Emitted a full broadcast envelope when the fee payer co-signed during eth_fillTransaction, enabling single round-trip sponsorship, and stripped feeToken from the sender's sign payload under sponsorship per the Tempo Transaction spec.

• #4654 038a062a8c2a875a3bbd58426e6060cf5d1d7986 Thanks @​deodad! - Added raw signing support to Tempo access key accounts.

[email protected]

Patch Changes

• #4647 423131df9e00e3df062274e483b98a4921674cea Thanks @​jxom! - Fixed Tempo chain declarations to emit portable inferred types for exported derived chains.

[email protected]

... (truncated)

• 3babb80 test: bump simulateBlocks gasUsed snapshot (#4703)
• c0959a2 docs: enable twoslash checkOnly (#4701)
• f810bbf docs(tempo): add Guides section (#4700)
• 1d91217 chore: version package (#4684)
• a01430b perf(site): prebuild viem types and drop twoslash paths override on build (...
• 51fb10c refactor(site): migrate vercel.json rewrites to vocs redirects (#4696)
• 1b69586 docs(tempo): add coming-soon warnings for T6 & T7 features (#4694)
• fb032ee feat(tempo): admin access key actions (#4689)
• b1bf866 fix(site): restore dynamic vocs rendering (#4693)
• fe06d8b refactor(tempo): omit witness from KeyAuthorization when undefined (#4692)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.