From 4854fb7b4b4155f84df883b0d6a197a33cff324c Mon Sep 17 00:00:00 2001 From: Sony Mathew Date: Thu, 9 Jul 2026 04:22:40 +0530 Subject: [PATCH] chore: upgrade websocket-driver (#14961) # Pull Request Template ## Description Updates `websocket-driver` from `0.7.7` to `0.8.2` to resolve the bundle-audit findings for CVE-2026-54463, CVE-2026-54464, CVE-2026-54465, and GHSA-2x63-gw47-w4mm. This is a lockfile-only transitive dependency update through Rails Action Cable. No application code changes are included. Fixes # (issue) N/A ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? - `bundle exec bundle audit update && bundle exec bundle audit check -v` - `bundle check && bundle exec ruby -e 'require "action_cable"; require "action_cable/connection/client_socket"; require "websocket/driver"; puts "actioncable=#{ActionCable::VERSION::STRING}"; puts "websocket-driver=#{Gem.loaded_specs["websocket-driver"].version}"; puts "driver_rack=#{WebSocket::Driver.respond_to?(:rack)}"'` - `POSTGRES_DATABASE=chatwoot_test_3d6a RAILS_ENV=test bundle exec rails db:prepare && POSTGRES_DATABASE=chatwoot_test_3d6a bundle exec rspec spec/listeners/action_cable_listener_spec.rb` - `git diff --check` ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [ ] I have commented on my code, particularly in hard-to-understand areas (not applicable; lockfile-only change) - [ ] I have made corresponding changes to the documentation (not applicable; dependency security update) - [x] My changes generate no new warnings - [ ] I have added tests that prove my fix is effective or that my feature works (not applicable; dependency security update) - [x] New and existing unit tests pass locally with my changes - [ ] Any dependent changes have been merged and published in downstream modules (not applicable) --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index bd41474a3..68674155e 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1030,7 +1030,7 @@ GEM addressable (>= 2.8.0) crack (>= 0.3.2) hashdiff (>= 0.4.0, < 2.0.0) - websocket-driver (0.7.7) + websocket-driver (0.8.2) base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5)