Skip to content

Upgrading ws 7 to 8

Breaking7.5.13 → 8.22.1Breaking15Security8Platform1New23Changed5Fixed23Other3

Full comparisonBack to ws
BreakingUpgrade verdict

14 breaking changes and a platform requirement change and 4 security fixes.

In plain terms
  • Events are now emitted synchronously by default, which can change the order in which your code runs.
  • An option that was added just a few days ago now has a new name, so anyone who already used the old name must switch to the new one.
  • Closing the server stops accepting new connections but leaves open ones running, so you must close them yourself.
  • Removing an event listener now affects only listeners added the same way, and removes just one.
Must act Top 5 of 19 that need code or config changes

Node.js requirement changed in 8.0.0: >=8.3.0 → >=10.0.0.

What you must change

Breaking14
The default value of the allowSynchronousEvents option is now true.
allowSynchronousEvents
8.17.0GitHub ReleaseSummarizedView source
Renames the allowMultipleEventsPerMicrotask option to allowSynchronousEvents.
allowMultipleEventsPerMicrotaskallowSynchronousEvents
8.15.1GitHub ReleaseSummarizedView source
WebSocketServer.prototype.close() no longer closes existing connections.
WebSocketServer.prototype.close()
8.0.0GitHub ReleaseSummarizedView source
WebSocket.prototype.removeEventListener() now only removes listeners added with addEventListener() and only one at a time.
WebSocket.prototype.removeEventListener()WebSocket.prototype.addEventListener()
8.0.0GitHub ReleaseSummarizedView source
The OpenEvent class has been removed.
OpenEvent
8.0.0GitHub ReleaseSummarizedView source
The WebSocket constructor now throws a SyntaxError if any subprotocol name is invalid or duplicated.
WebSocketSyntaxError
8.0.0GitHub ReleaseSummarizedView source
The server now aborts the opening handshake if an invalid Sec-WebSocket-Protocol header value is received.
Sec-WebSocket-Protocol
8.0.0GitHub ReleaseSummarizedView source
The protocols argument of the handleProtocols hook is now a Set instead of an Array.
handleProtocols
8.0.0GitHub ReleaseSummarizedView source
The opening handshake is aborted if the Sec-WebSocket-Extensions header value is empty or begins or ends with whitespace.
Sec-WebSocket-Extensions
8.0.0GitHub ReleaseSummarizedView source
Text messages and close reasons are passed as Buffers, and message listeners now receive an isBinary boolean argument.
Buffer
8.0.0GitHub ReleaseSummarizedView source
The package now uses an ES module wrapper.
8.0.0GitHub ReleaseSummarizedView source
The WebSocketServer.prototype.close() callback is now called with an error if the server is already closed.
WebSocketServer.prototype.close()
8.0.0GitHub ReleaseSummarizedView source
WebSocket.prototype.addEventListener() is now a noop for types other than close, error, message, or open.
WebSocket.prototype.addEventListener()
8.0.0GitHub ReleaseSummarizedView source
The onclose, onerror, onmessage, and onopen properties are now null when no handler is set.
oncloseonerroronmessageonopen
8.0.0GitHub ReleaseSummarizedView source
Security4
ws: Memory exhaustion DoS from tiny fragments and data chunks
High · CVSS 7.5
8.21.0GitHub AdvisoryOriginalView source
ws: Uninitialized memory disclosure
websocket.close()TypedArrayFloat32ArrayBufferModerate · CVSS 4.4
8.20.1GitHub AdvisoryOriginalView source
ws affected by a DoS when handling a request with many HTTP headers
server.maxHeadersCount--max-http-header-size=sizemaxHeaderSizeHigh · CVSS 7.5
8.17.1GitHub AdvisoryOriginalView source
Stops sending the Authorization and Cookie headers when following an insecure redirect (wss: to ws:) to the same host.
AuthorizationCookie
8.7.0GitHub ReleaseSummarizedView source
Platform1
Drops support for Node.js versions below 10.0.0.
8.0.0GitHub ReleaseSummarizedView source