Update ws package to latest non-vulnerable version (#4683)

libraries/botframework-streaming/package.json

@@ -33,7 +33,7 @@
     "@types/node": "^10.17.27",
     "@types/ws": "^6.0.3",
     "uuid": "^8.3.2",
-    "ws": "^7.1.2"
+    "ws": "^7.5.10"
   },
   "devDependencies": {
     "chai": "^4.2.0"

package.json

@@ -63,7 +63,6 @@
     "@azure/msal-node": "^1.18.4",
     "axios": "^1.7.2",
     "tar": "6.1.9",
-    "ws": "7.4.6",
     "glob-parent": "5.1.2"
   },
   "devDependencies": {

testing/browser-functional/browser-echo-bot/package.json

@@ -16,7 +16,7 @@
     "botbuilder-dialogs": "~4.5.1",
     "botframework-directlinejs": "~0.11.2",
     "botframework-webchat": "4.5.0",
-    "core-js": "^3.0.1"
+    "core-js": "^3.1.4"
   },
   "devDependencies": {
     "@babel/cli": "^7.23.0",
@@ -26,15 +26,15 @@
     "@babel/preset-typescript": "^7.23.2",
     "@babel/runtime": "^7.23.2",
     "babel-loader": "^8.0.6",
-    "clean-webpack-plugin": "^3.0.0",
-    "copy-webpack-plugin": "^5.0.3",
-    "core-js": "^3.1.4",
+    "clean-webpack-plugin": "^4.0.0",
+    "copy-webpack-plugin": "^11.0.0",
     "css-loader": "^3.0.0",
     "regenerator-runtime": "^0.13.2",
+    "stream-browserify": "^3.0.0",
     "style-loader": "^0.23.1",
-    "webpack": "^4.35.3",
-    "webpack-cli": "^3.3.6",
-    "webpack-dev-server": "^3.7.2"
+    "webpack": "^5.92.0",
+    "webpack-cli": "^5.1.4",
+    "webpack-dev-server": "^4.15.2"
   },
   "resolutions": {
     "follow-redirects": "^1.15.4"

testing/browser-functional/browser-echo-bot/webpack.config.js

@@ -6,13 +6,13 @@
 const { join, resolve } = require('path');
 const { CleanWebpackPlugin } = require('clean-webpack-plugin');
 const CopyWebpackPlugin = require('copy-webpack-plugin');
-const { HotModuleReplacementPlugin, NamedModulesPlugin } = require('webpack');
+const webpack = require('webpack');
 
 module.exports = {
     entry: './src/app.ts',
     devtool: 'source-map',
     devServer: {
-        contentBase: './dist',
+        static: './dist',
         hot: true
     },
     mode: 'development',
@@ -34,22 +34,35 @@ module.exports = {
     },
     plugins: [
         new CleanWebpackPlugin(),
-        new NamedModulesPlugin(),
-        new HotModuleReplacementPlugin(),
-        new CopyWebpackPlugin([
-            { from: resolve(__dirname, 'index.html'), to: '' }
-        ])
+        new CopyWebpackPlugin({
+            patterns: [
+                { from: resolve(__dirname, 'index.html'), to: '' }
+            ]
+        }),
+        // Work around for Buffer is undefined:
+        // https://github.com/webpack/changelog-v5/issues/10
+        new webpack.ProvidePlugin({
+            Buffer: ['buffer', 'Buffer'],
+        }),
+        new webpack.ProvidePlugin({
+            process: 'process/browser',
+        }),
     ],
     resolve: {
-        extensions: ['.css', '.js', '.ts']
+        extensions: ['.css', '.js', '.ts'],
+        fallback: {
+            fs: false,
+            net: false,
+            tls: false,
+            vm: false,
+            path: false,
+            crypto: false,
+            stream: require.resolve("stream-browserify"),
+            buffer: require.resolve("buffer")
+        }
     },
     output: {
         filename: 'app.js',
         path: resolve(__dirname, 'dist')
-    },
-    node: {
-        fs: 'empty',
-        net: 'empty',
-        tls: 'empty'
     }
 };

yarn.lock

@@ -14568,10 +14568,15 @@ write-file-atomic@^3.0.0:
     signal-exit "^3.0.2"
     typedarray-to-buffer "^3.1.5"
 
-ws@7.4.6, ws@>=8.7.0, ws@^7.1.2, ws@^8.2.3:
-  version "7.4.6"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-7.4.6.tgz#5654ca8ecdeee47c33a9a4bf6d28e2be2980377c"
-  integrity sha512-YmhHDO4MzaDLB+M9ym/mDA5z0naX8j7SIlT8f8z+I0VtzsRbekxEutHSme7NPS2qE8StCYQNUnfWdXta/Yu85A==
+ws@>=8.7.0, ws@^8.2.3:
+  version "8.17.1"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.17.1.tgz#9293da530bb548febc95371d90f9c878727d919b"
+  integrity sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ==
+
+ws@^7.5.10:
+  version "7.5.10"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.10.tgz#58b5c20dc281633f6c19113f39b349bd8bd558d9"
+  integrity sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==
 
 wsrun@^5.2.4:
   version "5.2.4"