Skip to content

build(deps): bump ws, @ethersproject/providers and ethers - #174

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-9e440b1b85
Open

build(deps): bump ws, @ethersproject/providers and ethers#174
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-9e440b1b85

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Bumps ws, @ethersproject/providers and ethers. These dependencies needed to be updated together.
Updates ws from 7.5.9 to 7.5.13

Release notes

Sourced from ws's releases.

7.5.13

Bug fixes

  • Fixed a bug introduced in version 7.5.12 that prevented the fragment counter from resetting (18bcb11a).

7.5.12

Bug fixes

  • Backported a2f4e7c0 and f197ac65 to the v7.x release line (fb8a1935, deec2114).

7.5.11

Bug fixes

  • Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

  • Backported e55e5106 to the 7.x release line (22c28763).
Commits
  • 1680801 [dist] 7.5.13
  • 18bcb11 [fix] Reset the fragment counter when the message is complete
  • 98fce81 [dist] 7.5.12
  • deec211 [fix] Lower default values of maxBufferedChunks and maxFragments
  • fb8a193 [fix] Count empty fragments toward the limit (#2329)
  • fd36cd8 [dist] 7.5.11
  • e14c458 [security] Limit retained message parts
  • d962d70 [dist] 7.5.10
  • 22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • See full diff in compare view

Updates @ethersproject/providers from 5.7.2 to 5.8.0

Release notes

Sourced from @​ethersproject/providers's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

  • Updated to latest elliptic library to fix audit warnings. (f8deaae)
  • Added ENS to Sepolia. (0065547)
  • Bump ws package version to address DoS security concern. (#4791; f345816)
  • Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>
Changelog

Sourced from @​ethersproject/providers's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

  • Updated to latest elliptic library to fix audit warnings. (f8deaae)
  • Added ENS to Sepolia. (0065547)
  • Bump ws package version to address DoS security concern. (#4791; f345816)
  • Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)
Commits
  • f345816 Bump ws package version to address DoS security concern (#4791).
  • fa5f647 admin: updated dist files
  • f7c813d Added modern networks, updated third-party backend URLs and added QuickNode (...
  • See full diff in compare view

Updates ethers from 5.7.2 to 5.8.0

Release notes

Sourced from ethers's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

  • Updated to latest elliptic library to fix audit warnings. (f8deaae)
  • Added ENS to Sepolia. (0065547)
  • Bump ws package version to address DoS security concern. (#4791; f345816)
  • Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>
Changelog

Sourced from ethers's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

  • Updated to latest elliptic library to fix audit warnings. (f8deaae)
  • Added ENS to Sepolia. (0065547)
  • Bump ws package version to address DoS security concern. (#4791; f345816)
  • Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)
Commits
  • 5ff3dc9 admin: updated dist files with update-versions
  • 808153e admin: updated sort issue in package.json
  • f8deaae Updated to latest elliptic library to fix audit warnings.
  • c6a1b15 Updated browser tests; but karma is still defunct
  • c7c07f5 admin: update dist files
  • 01dccc7 tests: swapped goerli for sepolia; contracts re-deployed
  • 0065547 Added ENS to Sepolia.
  • d7e8ad1 admin: updated dist files
  • f345816 Bump ws package version to address DoS security concern (#4791).
  • 9f42637 tests: updates test details
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump ws, @ethersproject/providers and ethers
f61df5f 
Bumps [ws](https://github.com/websockets/ws), [@ethersproject/providers](https://github.com/ethers-io/ethers.js/tree/HEAD/packages/providers) and [ethers](https://github.com/ethers-io/ethers.js). These dependencies needed to be updated together.

Updates `ws` from 7.5.9 to 7.5.13
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.9...7.5.13)

Updates `@ethersproject/providers` from 5.7.2 to 5.8.0
- [Release notes](https://github.com/ethers-io/ethers.js/releases)
- [Changelog](https://github.com/ethers-io/ethers.js/blob/v5.8.0/CHANGELOG.md)
- [Commits](https://github.com/ethers-io/ethers.js/commits/v5.8.0/packages/providers)

Updates `ethers` from 5.7.2 to 5.8.0
- [Release notes](https://github.com/ethers-io/ethers.js/releases)
- [Changelog](https://github.com/ethers-io/ethers.js/blob/v5.8.0/CHANGELOG.md)
- [Commits](ethers-io/ethers.js@v5.7.2...v5.8.0)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 7.5.13
  dependency-type: indirect
- dependency-name: "@ethersproject/providers"
  dependency-version: 5.8.0
  dependency-type: indirect
- dependency-name: ethers
  dependency-version: 5.8.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants