From c2bc6130bbc4f11360c9b88762183f6d9a7e9d94 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 6 Aug 2025 17:24:16 +0000 Subject: [PATCH 01/16] Bump actions/download-artifact from 4 to 5 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/sync-labels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 53a9f54..72ec06b 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -108,7 +108,7 @@ jobs: uses: actions/checkout@v4 - name: Download configuration files artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: ${{ env.CONFIGURATIONS_ARTIFACT }} path: ${{ env.CONFIGURATIONS_FOLDER }} From cb012cff2f585b565c9c8e2564356f99f4a61fec Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 12 Aug 2025 01:24:38 +0000 Subject: [PATCH 02/16] Bump actions/checkout from 4 to 5 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-arduino.yml | 2 +- .github/workflows/compile-examples.yml | 2 +- .github/workflows/spell-check.yml | 2 +- .github/workflows/sync-labels.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/check-arduino.yml b/.github/workflows/check-arduino.yml index e818685..e13b990 100644 --- a/.github/workflows/check-arduino.yml +++ b/.github/workflows/check-arduino.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Arduino Lint uses: arduino/arduino-lint-action@v2 diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml index 0dd5ac7..e3d6674 100644 --- a/.github/workflows/compile-examples.yml +++ b/.github/workflows/compile-examples.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Compile examples uses: arduino/compile-sketches@v1 diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index ef7d894..19f5d38 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Spell check uses: codespell-project/actions-codespell@master diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 72ec06b..62c898a 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Download JSON schema for labels configuration file id: download-schema @@ -105,7 +105,7 @@ jobs: echo "::set-output name=flag::--dry-run" - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Download configuration files artifact uses: actions/download-artifact@v5 From dfeb94a8a99aa0aca0cd4b078cc7dffc6c13e5eb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Oct 2025 17:30:31 +0000 Subject: [PATCH 03/16] Bump actions/download-artifact from 5 to 6 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5 to 6. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/sync-labels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 62c898a..96b9914 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -108,7 +108,7 @@ jobs: uses: actions/checkout@v5 - name: Download configuration files artifact - uses: actions/download-artifact@v5 + uses: actions/download-artifact@v6 with: name: ${{ env.CONFIGURATIONS_ARTIFACT }} path: ${{ env.CONFIGURATIONS_FOLDER }} From a8c9a38e5094b109bf2920545e747cb99d8877c6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Oct 2025 18:05:16 +0000 Subject: [PATCH 04/16] Bump actions/upload-artifact from 4 to 5 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/compile-examples.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml index e3d6674..6f25631 100644 --- a/.github/workflows/compile-examples.yml +++ b/.github/workflows/compile-examples.yml @@ -56,7 +56,7 @@ jobs: sketches-report-path: ${{ env.SKETCHES_REPORTS_PATH }} - name: Save sketches report as workflow artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: if-no-files-found: error path: ${{ env.SKETCHES_REPORTS_PATH }} diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 62c898a..23a751a 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -70,7 +70,7 @@ jobs: file-url: https://raw.githubusercontent.com/arduino/tooling-project-assets/main/workflow-templates/assets/sync-labels/${{ matrix.filename }} - name: Pass configuration files to next job via workflow artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: path: | *.yaml From 9d3efbf1ec2d4d1197a4cf92a4164c880be3ceca Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Nov 2025 17:01:26 +0000 Subject: [PATCH 05/16] Bump actions/checkout from 5 to 6 Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-arduino.yml | 2 +- .github/workflows/compile-examples.yml | 2 +- .github/workflows/spell-check.yml | 2 +- .github/workflows/sync-labels.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/check-arduino.yml b/.github/workflows/check-arduino.yml index e13b990..97b2bf2 100644 --- a/.github/workflows/check-arduino.yml +++ b/.github/workflows/check-arduino.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Arduino Lint uses: arduino/arduino-lint-action@v2 diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml index 6f25631..899990f 100644 --- a/.github/workflows/compile-examples.yml +++ b/.github/workflows/compile-examples.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Compile examples uses: arduino/compile-sketches@v1 diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index 19f5d38..8fc4b8c 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Spell check uses: codespell-project/actions-codespell@master diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index cb55211..d49c1cb 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Download JSON schema for labels configuration file id: download-schema @@ -105,7 +105,7 @@ jobs: echo "::set-output name=flag::--dry-run" - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Download configuration files artifact uses: actions/download-artifact@v6 From 0a14d352e47e47dfd6457da234bb3bed27849a34 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 15 Dec 2025 17:01:22 +0000 Subject: [PATCH 06/16] Bump actions/upload-artifact from 5 to 6 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/compile-examples.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml index 899990f..0a863bc 100644 --- a/.github/workflows/compile-examples.yml +++ b/.github/workflows/compile-examples.yml @@ -56,7 +56,7 @@ jobs: sketches-report-path: ${{ env.SKETCHES_REPORTS_PATH }} - name: Save sketches report as workflow artifact - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@v6 with: if-no-files-found: error path: ${{ env.SKETCHES_REPORTS_PATH }} diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index d49c1cb..ad0e59e 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -70,7 +70,7 @@ jobs: file-url: https://raw.githubusercontent.com/arduino/tooling-project-assets/main/workflow-templates/assets/sync-labels/${{ matrix.filename }} - name: Pass configuration files to next job via workflow artifact - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@v6 with: path: | *.yaml From e9b2396269d23f53809f77b6fec222c9a450b861 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 15 Dec 2025 17:01:25 +0000 Subject: [PATCH 07/16] Bump actions/download-artifact from 6 to 7 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6 to 7. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/sync-labels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index d49c1cb..485e8e6 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -108,7 +108,7 @@ jobs: uses: actions/checkout@v6 - name: Download configuration files artifact - uses: actions/download-artifact@v6 + uses: actions/download-artifact@v7 with: name: ${{ env.CONFIGURATIONS_ARTIFACT }} path: ${{ env.CONFIGURATIONS_FOLDER }} From a7b582b1957045f75246059336536f6da8eb7f7f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 27 Feb 2026 17:12:23 +0000 Subject: [PATCH 08/16] Bump actions/upload-artifact from 6 to 7 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/compile-examples.yml | 2 +- .github/workflows/sync-labels.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml index 0a863bc..4f210b7 100644 --- a/.github/workflows/compile-examples.yml +++ b/.github/workflows/compile-examples.yml @@ -56,7 +56,7 @@ jobs: sketches-report-path: ${{ env.SKETCHES_REPORTS_PATH }} - name: Save sketches report as workflow artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: if-no-files-found: error path: ${{ env.SKETCHES_REPORTS_PATH }} diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 6808710..9400f39 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -70,7 +70,7 @@ jobs: file-url: https://raw.githubusercontent.com/arduino/tooling-project-assets/main/workflow-templates/assets/sync-labels/${{ matrix.filename }} - name: Pass configuration files to next job via workflow artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: path: | *.yaml From ac237da104f50ee77b2612bc183115d213789896 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 27 Feb 2026 17:12:27 +0000 Subject: [PATCH 09/16] Bump actions/download-artifact from 7 to 8 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v7...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/sync-labels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 6808710..4583c9d 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -108,7 +108,7 @@ jobs: uses: actions/checkout@v6 - name: Download configuration files artifact - uses: actions/download-artifact@v7 + uses: actions/download-artifact@v8 with: name: ${{ env.CONFIGURATIONS_ARTIFACT }} path: ${{ env.CONFIGURATIONS_FOLDER }} From 35b468e54425c6e214a27676acffdf31df195589 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 17:54:23 +0000 Subject: [PATCH 10/16] Bump geekyeggo/delete-artifact from 5 to 6 Bumps [geekyeggo/delete-artifact](https://github.com/geekyeggo/delete-artifact) from 5 to 6. - [Release notes](https://github.com/geekyeggo/delete-artifact/releases) - [Changelog](https://github.com/GeekyEggo/delete-artifact/blob/main/CHANGELOG.md) - [Commits](https://github.com/geekyeggo/delete-artifact/compare/v5...v6) --- updated-dependencies: - dependency-name: geekyeggo/delete-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/sync-labels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index 48b83cd..c549f37 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -114,7 +114,7 @@ jobs: path: ${{ env.CONFIGURATIONS_FOLDER }} - name: Remove unneeded artifact - uses: geekyeggo/delete-artifact@v5 + uses: geekyeggo/delete-artifact@v6 with: name: ${{ env.CONFIGURATIONS_ARTIFACT }} From d964f58c54132d3563993017212ad9c01101e587 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 18 Jun 2026 17:12:22 +0000 Subject: [PATCH 11/16] Bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-arduino.yml | 2 +- .github/workflows/compile-examples.yml | 2 +- .github/workflows/spell-check.yml | 2 +- .github/workflows/sync-labels.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/check-arduino.yml b/.github/workflows/check-arduino.yml index 97b2bf2..452a94f 100644 --- a/.github/workflows/check-arduino.yml +++ b/.github/workflows/check-arduino.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Arduino Lint uses: arduino/arduino-lint-action@v2 diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml index 4f210b7..005d046 100644 --- a/.github/workflows/compile-examples.yml +++ b/.github/workflows/compile-examples.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Compile examples uses: arduino/compile-sketches@v1 diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index 8fc4b8c..8717032 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Spell check uses: codespell-project/actions-codespell@master diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index c549f37..83615bc 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Download JSON schema for labels configuration file id: download-schema @@ -105,7 +105,7 @@ jobs: echo "::set-output name=flag::--dry-run" - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Download configuration files artifact uses: actions/download-artifact@v8 From d4274ebb56d7cc45619e9a1f852661cab598fad4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Jul 2026 17:12:17 +0000 Subject: [PATCH 12/16] Bump arduino/arduino-lint-action from 2 to 3 Bumps [arduino/arduino-lint-action](https://github.com/arduino/arduino-lint-action) from 2 to 3. - [Release notes](https://github.com/arduino/arduino-lint-action/releases) - [Commits](https://github.com/arduino/arduino-lint-action/compare/v2...v3) --- updated-dependencies: - dependency-name: arduino/arduino-lint-action dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-arduino.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-arduino.yml b/.github/workflows/check-arduino.yml index 452a94f..be200da 100644 --- a/.github/workflows/check-arduino.yml +++ b/.github/workflows/check-arduino.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@v7 - name: Arduino Lint - uses: arduino/arduino-lint-action@v2 + uses: arduino/arduino-lint-action@v3 with: compliance: specification library-manager: update From af935ce9df346f1d2ea94c1529a7f8f5577a82e7 Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 12:34:35 +0200 Subject: [PATCH 13/16] Fix typo in WebSocketClient::write buffer size clamp Use sizeof(iTxBuffer) instead of sizeof(iTxSize) when computing the remaining space, preventing truncated writes and potential memcpy overflow. --- src/WebSocketClient.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index ab41b0a..7edc502 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -167,7 +167,7 @@ size_t WebSocketClient::write(const uint8_t *aBuffer, size_t aSize) // check if the write size, fits in the buffer if ((iTxSize + aSize) > sizeof(iTxBuffer)) { - aSize = sizeof(iTxSize) - iTxSize; + aSize = sizeof(iTxBuffer) - iTxSize; } // copy data into the buffer From eed84b6cd6f7eca3fc5bf2ed6e2c3c48a25f63c8 Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 15:50:01 +0200 Subject: [PATCH 14/16] WebSocketClient: fix undefined read order in frame length Multiple read() calls in one expression have unspecified evaluation order in C++, so the length bytes could be combined wrong. Read each byte into its own variable before combining them. --- src/WebSocketClient.cpp | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index ab41b0a..437748d 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -213,18 +213,30 @@ int WebSocketClient::parseMessage() } else if (length == 126) { - iRxSize = (HttpClient::read() << 8) | HttpClient::read(); + // read each byte in a well-defined order (the evaluation order of + // multiple read() calls in a single expression is unspecified) + uint8_t b1 = HttpClient::read(); + uint8_t b0 = HttpClient::read(); + iRxSize = ((uint64_t)b1 << 8) | b0; } else { - iRxSize = ((uint64_t)HttpClient::read() << 56) | - ((uint64_t)HttpClient::read() << 48) | - ((uint64_t)HttpClient::read() << 40) | - ((uint64_t)HttpClient::read() << 32) | - ((uint64_t)HttpClient::read() << 24) | - ((uint64_t)HttpClient::read() << 16) | - ((uint64_t)HttpClient::read() << 8) | - (uint64_t)HttpClient::read(); + uint8_t b7 = HttpClient::read(); + uint8_t b6 = HttpClient::read(); + uint8_t b5 = HttpClient::read(); + uint8_t b4 = HttpClient::read(); + uint8_t b3 = HttpClient::read(); + uint8_t b2 = HttpClient::read(); + uint8_t b1 = HttpClient::read(); + uint8_t b0 = HttpClient::read(); + iRxSize = ((uint64_t)b7 << 56) | + ((uint64_t)b6 << 48) | + ((uint64_t)b5 << 40) | + ((uint64_t)b4 << 32) | + ((uint64_t)b3 << 24) | + ((uint64_t)b2 << 16) | + ((uint64_t)b1 << 8) | + (uint64_t)b0; } // read in the mask, if present From 532b516b73857dadd972bb464f96590821b64acd Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 15:50:15 +0200 Subject: [PATCH 15/16] WebSocketClient: simplify RX size branching Default iRxSize to the inline length and only override it for the 126/127 extended-length cases. No behavioural change. --- src/WebSocketClient.cpp | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index 437748d..f7c1ddc 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -207,11 +207,8 @@ int WebSocketClient::parseMessage() length &= 0x7f; // read the RX size - if (length < 126) - { - iRxSize = length; - } - else if (length == 126) + iRxSize = length; + if (length == 126) { // read each byte in a well-defined order (the evaluation order of // multiple read() calls in a single expression is unspecified) @@ -219,7 +216,7 @@ int WebSocketClient::parseMessage() uint8_t b0 = HttpClient::read(); iRxSize = ((uint64_t)b1 << 8) | b0; } - else + else if (length == 127) { uint8_t b7 = HttpClient::read(); uint8_t b6 = HttpClient::read(); From d0a757775795fa0e84dd0c6d5bfede2d5ed634e7 Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 15:50:30 +0200 Subject: [PATCH 16/16] WebSocketClient: check extended length/mask bytes are available Only 2 header bytes were guaranteed before reading the extended length and mask, so a partial header made read() return -1 and corrupt iRxSize. Bail out until all header bytes have arrived. --- src/WebSocketClient.cpp | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index f7c1ddc..e97d4a9 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -206,6 +206,26 @@ int WebSocketClient::parseMessage() iRxMasked = (length & 0x80); length &= 0x7f; + // work out how many extended length and mask bytes follow the + // initial opcode + length bytes + int extendedLength = 0; + if (length == 126) + { + extendedLength = 2; + } + else if (length == 127) + { + extendedLength = 8; + } + int maskLength = iRxMasked ? (int)sizeof(iRxMaskKey) : 0; + + // make sure the remaining header bytes are available before reading + // them, otherwise the frame header is incomplete + if (HttpClient::available() < (extendedLength + maskLength)) + { + return 0; + } + // read the RX size iRxSize = length; if (length == 126)