[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
amqplib (source)	^2.2.1 → ^2.3.1
ws	^8.22.1 → ^8.22.2

---

Release Notes

amqp-node/amqplib (amqplib)

v2.3.1

Compare Source

• Throw a clear RangeError from publish when an encoded headers or arguments table exceeds the 64 KiB encoding buffer. Previously the outcome depended on where the boundary fell: a string or Buffer value crossing the end of the buffer was silently truncated, producing a frame whose table length prefix did not match its contents, which RabbitMQ rejected by closing the connection with a 541 INTERNAL_ERROR after publish had returned; at other positions a bare offset is out of range error escaped from publish instead (fixes #​867)

v2.3.0

Compare Source

• Reject a connection.tune whose frameMax is below the protocol minimum of 4096 (the spec allows 0 or at least frame-min-size). Previously such a value was accepted, and the first publish whose encoded frames total 2048 bytes or more entered a loop in sendContent that never advanced, exhausting memory. sendContent now also throws if frameMax leaves no room for a body frame (GHSA-37f9-7m79-6866, reported by Rizwan Bedekar (@​r-bedekar); fix based in part on their patch and tests)
• Add a maxFrameSize connection option, also settable as a URL query parameter, bounding the payload size of frames accepted from the server. The default is 64 MiB, or the negotiated frameMax if that is larger, so raising frameMax needs no second option; 0 disables the limit. Incoming frame sizes were previously unchecked, so a frame header declaring up to 4 GiB made the client buffer, and repeatedly re-copy, that much data before looking at it. An oversized frame is now refused from its header alone and closes the connection with Frame size N exceeds maxFrameSize M. The limit is deliberately separate from the negotiated frameMax, since some brokers send larger frames without splitting them (see #​784). Upgrade note: a broker that delivers an unsplit frame larger than the limit will now have that connection closed; pass maxFrameSize: 0, or a higher value, to restore the previous behaviour (GHSA-37f9-7m79-6866)

websockets/ws (ws)

v8.22.2

Compare Source

Bug fixes

• The userinfo of the URL is now percent-decoded (#​2352).
• The WebSocket constructor no longer mutates http: or https: url.URL
  objects (#​2353).

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!