chore(deps): update module github.com/gorilla/websocket to v1.5.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gorilla/websocket	v1.5.0 → v1.5.3

---

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

GHSA-w67g-5rqw-f597

More information

Details

gorilla/websocket used math/rand (cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with a known value, enabling an attacker to predict or recover mask keys and inject content into WebSocket connections.

Type: Use of Cryptographically Weak Pseudo-Random Number Generator
Fix: Replaced math/rand with crypto/rand (commit d67f4185, released in v1.5.3)
Credit: bounty-hunter v6.0 silent-fix detection

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/canolgun-commits/websocket/security/advisories/GHSA-w67g-5rqw-f597
• https://github.com/gorilla/websocket/commit/d67f41855da42d7bccd9ef050c49f7e54e783b95
• https://github.com/gorilla/websocket/releases/tag/v1.5.3
• https://github.com/advisories/GHSA-w67g-5rqw-f597

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

gorilla/websocket (github.com/gorilla/websocket)

v1.5.3

Compare Source

Important change

This reverts the websockets package back to 931041c

What's Changed

• Fixes subprotocol selection (aling with rfc6455) by @​KSDaemon in #​823
• Update README.md, replace master to main by @​mstmdev in #​862
• Use status code constant by @​mstmdev in #​864
• conn.go: default close handler should not return ErrCloseSent. by @​pnx in #​865
• fix: replace ioutil.readfile with os.readfile by @​rfyiamcool in #​868
• fix: add comment for the readBufferSize and writeBufferSize by @​rfyiamcool in #​869
• Remove noisy printf in NextReader() and beginMessage() by @​bcreane in #​878
• docs(echoreadall): fix function echoReadAll comment by @​XdpCs in #​881
• make tests parallel by @​ninedraft in #​872
• Upgrader.Upgrade: use http.ResposnseController by @​ninedraft in #​871
• Do not handle network error in SetCloseHandler() by @​nak3 in #​863
• perf: reduce timer in write_control by @​rfyiamcool in #​879
• fix: lint example code by @​rfyiamcool in #​890
• feat: format message type by @​rfyiamcool in #​889
• Remove hideTempErr to allow downstream users to check for errors like net.ErrClosed by @​UnAfraid in #​894
• Do not timeout when WriteControl deadline is zero in #​898
• Excludes errchecks linter by @​apoorvajagtap in #​904
• Return errors instead of printing to logs by @​apoorvajagtap in #​897
• Revert " Update go version & add verification/testing tools (#​840)" by @​apoorvajagtap in #​908
• Fixes broken random value generation by @​apoorvajagtap in #​926
• Reverts back to v1.5.0 by @​apoorvajagtap in #​929

New Contributors

• @​KSDaemon made their first contribution in #​823
• @​mstmdev made their first contribution in #​862
• @​pnx made their first contribution in #​865
• @​rfyiamcool made their first contribution in #​868
• @​bcreane made their first contribution in #​878
• @​XdpCs made their first contribution in #​881
• @​ninedraft made their first contribution in #​872
• @​nak3 made their first contribution in #​863
• @​UnAfraid made their first contribution in #​894
• @​apoorvajagtap made their first contribution in #​904

Full Changelog: gorilla/websocket@v1.5.1...v1.5.3

v1.5.2

Compare Source

What's Changed

• Fixes subprotocol selection (aling with rfc6455) by @​KSDaemon in #​823
• Update README.md, replace master to main by @​mstmdev in #​862
• Use status code constant by @​mstmdev in #​864
• conn.go: default close handler should not return ErrCloseSent. by @​pnx in #​865
• fix: replace ioutil.readfile with os.readfile by @​rfyiamcool in #​868
• fix: add comment for the readBufferSize and writeBufferSize by @​rfyiamcool in #​869
• Remove noisy printf in NextReader() and beginMessage() by @​bcreane in #​878
• docs(echoreadall): fix function echoReadAll comment by @​XdpCs in #​881
• make tests parallel by @​ninedraft in #​872
• Upgrader.Upgrade: use http.ResposnseController by @​ninedraft in #​871
• Do not handle network error in SetCloseHandler() by @​nak3 in #​863
• perf: reduce timer in write_control by @​rfyiamcool in #​879
• fix: lint example code by @​rfyiamcool in #​890
• feat: format message type by @​rfyiamcool in #​889
• Remove hideTempErr to allow downstream users to check for errors like net.ErrClosed by @​UnAfraid in #​894
• Do not timeout when WriteControl deadline is zero in #​898
• Excludes errchecks linter by @​apoorvajagtap in #​904
• Return errors instead of printing to logs by @​apoorvajagtap in #​897
• Revert " Update go version & add verification/testing tools (#​840)" by @​apoorvajagtap in #​908
• Fixes broken random value generation by @​apoorvajagtap in #​926

New Contributors

• @​KSDaemon made their first contribution in #​823
• @​mstmdev made their first contribution in #​862
• @​pnx made their first contribution in #​865
• @​rfyiamcool made their first contribution in #​868
• @​bcreane made their first contribution in #​878
• @​XdpCs made their first contribution in #​881
• @​ninedraft made their first contribution in #​872
• @​nak3 made their first contribution in #​863
• @​UnAfraid made their first contribution in #​894
• @​apoorvajagtap made their first contribution in #​904

Full Changelog: gorilla/websocket@v1.5.1...v1.5.2

v1.5.1

Compare Source

What's Changed

• Add check for Sec-WebSocket-Key header by @​hirasawayuki in #​752
• Changed the method name UnderlyingConn to NetConn by @​JWSong in #​773
• remove all versions < 1.16 and add 1.18 by @​ChannyClaus in #​793
• Check for and report bad protocol in TLSClientConfig.NextProtos by @​ChannyClaus in #​788
• check err before GotConn for trace by @​junnplus in #​798
• Update README.md by @​coreydaley in #​839
• Correct way to save memory using write buffer pool and freeing net.http default buffers by @​FMLS in #​761
• Update go version & add verification/testing tools by @​coreydaley in #​840
• update golang.org/x/net by @​coreydaley in #​856
• update GitHub workflows by @​coreydaley in #​857

New Contributors

• @​hirasawayuki made their first contribution in #​752
• @​JWSong made their first contribution in #​773
• @​ChannyClaus made their first contribution in #​793
• @​junnplus made their first contribution in #​798
• @​coreydaley made their first contribution in #​839
• @​FMLS made their first contribution in #​761

Full Changelog: gorilla/websocket@v1.5.0...v1.5.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.