Features

• Added closeTimeout option (#2308)

Bug fixes

• Handled breaking change in Node.js core (19984854)

Bug fixes

• Fixed a spec violation where the Sec-WebSocket-Version header was not added to the HTTP response if the client requested version was either invalid or unacceptable (#2291).

Bug fixes

• Fixed an issue that, during message decompression when the maximum size was exceeded, led to the emission of an inaccurate error and closure of the connection with an improper close code (#2285).

Bug fixes

• The length of the UNIX domain socket paths in the tests has been shortened to make them work when run via CITGM (021f7b8b).

Features

• Added support for Blob (#2229).

Bug fixes

• Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');...

Bug fixes

• Backported e55e5106 to the 6.x release line (eeb76d31).

Bug fixes

• Backported e55e5106 to the 7.x release line (22c28763).

Bug fixes

• Backported e55e5106 to the 5.x release line (4abd8f6d).

Features

• The WebSocket constructor now accepts the createConnection option (#2219).

Other notable changes

• The default value of the allowSynchronousEvents option has been changed to true (#2221).

This is a breaking change in a patch release. The assumption is that the option is not widely used.