diff --git a/.circleci/config.yml b/.circleci/config.yml
index 40caefd886..268ceb57c3 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -424,7 +424,7 @@ parameters:
     type: string
   dev_git_branch: # change to feature branch to test deployment
     description: "Name of github branch that will deploy to dev"
-    default: "lr/ttahub-1521/display-regions-in-AR-header"
+    default: "mb/TTAHUB-3007/no-disallowed-urls"
     type: string
   sandbox_git_branch:  # change to feature branch to test deployment
     default: "al-ttahub-add-fei-root-cause-to-review"
diff --git a/frontend/package.json b/frontend/package.json
index 435b09e172..bc4e507bfd 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -12,7 +12,7 @@
     "@silevis/reactgrid": "3.1",
     "@react-hook/resize-observer": "^1.2.6",
     "@trussworks/react-uswds": "4.1.1",
-    "@ttahub/common": "^2.1.3",
+    "@ttahub/common": "^2.1.5",
     "@use-it/interval": "^1.0.0",
     "async": "^3.2.3",
     "browserslist": "^4.16.5",
diff --git a/frontend/src/components/GoalForm/ResourceRepeater.js b/frontend/src/components/GoalForm/ResourceRepeater.js
index f90c56a3a0..fc5756728f 100644
--- a/frontend/src/components/GoalForm/ResourceRepeater.js
+++ b/frontend/src/components/GoalForm/ResourceRepeater.js
@@ -1,4 +1,5 @@
 import React from 'react';
+import { isValidResourceUrl } from '@ttahub/common';
 import PropTypes from 'prop-types';
 import { v4 as uuidv4 } from 'uuid';
 import {
@@ -11,7 +12,6 @@ import QuestionTooltip from './QuestionTooltip';
 import URLInput from '../URLInput';
 import colors from '../../colors';
 import './ResourceRepeater.scss';
-import { OBJECTIVE_LINK_ERROR } from './constants';
 
 export default function ResourceRepeater({
   resources,
@@ -19,10 +19,12 @@ export default function ResourceRepeater({
   error,
   validateResources,
   toolTipText,
-  validateOnRemove,
   isLoading,
 }) {
   const addResource = () => {
+    if ((error.props.children) || resources.some((r) => !r.value)) {
+      return;
+    }
     const newResources = [...resources, { key: uuidv4(), value: '' }];
     setResources(newResources);
   };
@@ -31,20 +33,12 @@ export default function ResourceRepeater({
     const newResources = [...resources];
     newResources.splice(i, 1);
     setResources(newResources);
-
-    // This is an attempt to handle on remove validation for resources.
-    // the AR and RTR use two different approaches to validation.
-    // This works around it by allowing the parent component to pass in a validation function.
-    if (validateOnRemove) {
-      validateOnRemove(newResources);
-    } else {
-      validateResources();
-    }
+    validateResources();
   };
 
   const updateResource = (value, i) => {
     const newResources = [...resources];
-    const toUpdate = { ...newResources[i], value };
+    const toUpdate = { ...newResources[i], value: value.trim() };
     newResources.splice(i, 1, toUpdate);
     setResources(newResources);
   };
@@ -64,10 +58,10 @@ export default function ResourceRepeater({
               Enter one resource per field. To enter more resources, select “Add new resource”
             </span>
           </Fieldset>
-          {error.props.children ? OBJECTIVE_LINK_ERROR : null}
+          {error.props.children ? error : null}
           <div className="ttahub-resource-repeater">
             { resources.map((r, i) => (
-              <div key={r.key} className="display-flex" id="resources">
+              <div key={r.key} className={`display-flex${r.value && !isValidResourceUrl(r.value) ? ' ttahub-resource__error' : ''}`} id="resources">
                 <Label htmlFor={`resource-${i + 1}`} className="sr-only">
                   Resource
                   {' '}
@@ -77,7 +71,7 @@ export default function ResourceRepeater({
                   id={`resource-${i + 1}`}
                   onBlur={validateResources}
                   onChange={({ target: { value } }) => updateResource(value, i)}
-                  value={r.value}
+                  value={r.value || ''}
                   disabled={isLoading}
                 />
                 { resources.length > 1 ? (
@@ -113,11 +107,9 @@ ResourceRepeater.propTypes = {
   validateResources: PropTypes.func.isRequired,
   isLoading: PropTypes.bool,
   toolTipText: PropTypes.string,
-  validateOnRemove: PropTypes.func,
 };
 
 ResourceRepeater.defaultProps = {
   isLoading: false,
   toolTipText: 'Copy & paste web address of TTA resource used for this objective. Usually an ECLKC page.',
-  validateOnRemove: null,
 };
diff --git a/frontend/src/components/GoalForm/ResourceRepeater.scss b/frontend/src/components/GoalForm/ResourceRepeater.scss
index 5918312c65..807e274558 100644
--- a/frontend/src/components/GoalForm/ResourceRepeater.scss
+++ b/frontend/src/components/GoalForm/ResourceRepeater.scss
@@ -6,7 +6,7 @@
   }
 }
 
-.usa-error-message + .ttahub-resource-repeater input[type="url"] {
+.ttahub-resource__error input[type="url"] {
     @include mixins.error;
 }
 
diff --git a/frontend/src/components/GoalForm/__tests__/ResourceRepeater.js b/frontend/src/components/GoalForm/__tests__/ResourceRepeater.js
index 134cad9bc6..32dfa0d049 100644
--- a/frontend/src/components/GoalForm/__tests__/ResourceRepeater.js
+++ b/frontend/src/components/GoalForm/__tests__/ResourceRepeater.js
@@ -1,8 +1,12 @@
 import '@testing-library/jest-dom';
 import React from 'react';
 import {
-  render, screen, fireEvent,
+  render,
+  screen,
+  fireEvent,
+  act,
 } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
 import ResourceRepeater from '../ResourceRepeater';
 
 describe('ResourceRepeater', () => {
@@ -76,29 +80,54 @@ describe('ResourceRepeater', () => {
     expect(screen.queryAllByText("Copy & paste web address of TTA resource you'll use for this objective. Usually an ECLKC page.").length).toBe(2);
   });
 
-  it('calls validateOnRemove() when a resource is removed', async () => {
-    const validateOnRemoveMock = jest.fn();
-    const resources = [
-      { key: 1, value: 'http://www.resources.com' },
-      { key: 2, value: 'http://www.resources2.com' },
-    ];
-
+  it('cannot add a resource if the first is blank', async () => {
+    const setResources = jest.fn();
     render(<ResourceRepeater
       error={<></>}
-      resources={resources}
-      setResources={jest.fn()}
+      resources={[
+        { key: 1, value: '' },
+      ]}
+      setResources={setResources}
       validateResources={jest.fn()}
       status="In Progress"
       isOnReport={false}
       isLoading={false}
       goalStatus="In Progress"
       userCanEdit
-      validateOnRemove={validateOnRemoveMock}
     />);
 
-    const removeButton = screen.getByRole('button', { name: /remove resource 1/i });
-    fireEvent.click(removeButton);
+    const addButton = screen.getByRole('button', { name: /add new resource/i });
+    act(() => {
+      userEvent.click(addButton);
+    });
+
+    expect(setResources).not.toHaveBeenCalled();
+    const urlInputs = document.querySelectorAll('input[type="url"]');
+    expect(urlInputs.length).toBe(1);
+  });
+  it('cannot add a resource if there is an error', async () => {
+    const setResources = jest.fn();
+    render(<ResourceRepeater
+      error={<span className="usa-error">This is an error</span>}
+      resources={[
+        { key: 1, value: 'garbelasdf' },
+      ]}
+      setResources={setResources}
+      validateResources={jest.fn()}
+      status="In Progress"
+      isOnReport={false}
+      isLoading={false}
+      goalStatus="In Progress"
+      userCanEdit
+    />);
+
+    const addButton = screen.getByRole('button', { name: /add new resource/i });
+    act(() => {
+      userEvent.click(addButton);
+    });
 
-    expect(validateOnRemoveMock).toHaveBeenCalled();
+    expect(setResources).not.toHaveBeenCalled();
+    const urlInputs = document.querySelectorAll('input[type="url"]');
+    expect(urlInputs.length).toBe(1);
   });
 });
diff --git a/frontend/src/components/GoalForm/__tests__/constants.js b/frontend/src/components/GoalForm/__tests__/constants.js
index d998999b3a..4fe3398d00 100644
--- a/frontend/src/components/GoalForm/__tests__/constants.js
+++ b/frontend/src/components/GoalForm/__tests__/constants.js
@@ -4,84 +4,104 @@ import {
   FORM_FIELD_INDEXES,
   objectivesWithValidResourcesOnly,
   grantsToMultiValue,
+  noDisallowedUrls,
 } from '../constants';
 
 describe('form constants', () => {
   it('the amount of form fields and the amount of default errors should match', () => {
     expect(Object.keys(FORM_FIELD_INDEXES).length).toBe(FORM_FIELD_DEFAULT_ERRORS.length);
   });
-});
 
-describe('objectivesWithValidResourcesOnly', () => {
-  it('strips invalid resources', () => {
-    const objectives = [
-      {
-        resources: [
-          { value: 'https://www.google.com' },
-          { value: 'not a valid url' },
-          { value: 'https://www.google.com' },
-          { value: 'https://www.google.com ' },
-          { value: ' https://www.google.com' },
-        ],
-      },
+  describe('noDisallowedUrls', () => {
+    const goodUrls = [{ value: 'https://www.google.com' }];
+
+    const badUrls = [
+      'https://eclkc.ohs.acf.hhs.gov/professional-development/individualized-professional-development-ipd-portfolio/course-catalog',
+      'https://eclkc.ohs.acf.hhs.gov/professional-development/individualized-professional-development-ipd-portfolio/individualized-professional-development-ipd-portfolio',
+      'https://eclkc.ohs.acf.hhs.gov/cas/login',
     ];
 
-    expect(objectivesWithValidResourcesOnly(objectives)).toEqual([
-      {
-        resources: [
-          { value: 'https://www.google.com' },
-          { value: 'https://www.google.com' },
-          { value: 'https://www.google.com' },
-          { value: 'https://www.google.com' },
-        ],
-      },
-    ]);
+    it('returns true if the url is not in the disallowed list', () => {
+      expect(noDisallowedUrls(goodUrls)).toBe(true);
+    });
+
+    it('returns false if the url is in the disallowed list', () => {
+      badUrls.forEach((url) => {
+        expect(noDisallowedUrls([{ value: url }])).toBe('This link is no longer accepted in this field. Enter iPD courses used during your TTA session in the other field in this section.');
+      });
+    });
   });
-});
 
-describe('validateListOfResources', () => {
-  it('returns false if there is an invalid resource', () => {
-    expect(validateListOfResources([{ value: 'http://www.test-domain.com/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain' }])).toBe(true);
-    expect(validateListOfResources([{ value: 'https://test.com' }])).toBe(true);
-    expect(validateListOfResources([{ value: 'http://test.com' }])).toBe(true);
-    expect(validateListOfResources([{ value: 'https://www.test.com' }])).toBe(true);
-    expect(validateListOfResources([{ value: 'http://www.test.com' }])).toBe(true);
-    expect(validateListOfResources([{ value: 'file://test.com' }])).toBe(false);
-    expect(validateListOfResources([{ value: 'http://test' }])).toBe(false);
-    expect(validateListOfResources([{ value: 'https://test' }])).toBe(false);
-    expect(validateListOfResources([{ value: 'http:mickeymouse.com' }])).toBe(false);
-    expect(validateListOfResources([{ value: 'http://google.comhttp://ask.comhttp://aol.com' }])).toBe(false);
-    expect(validateListOfResources([{ value: ' https://eclkc.ohs.acf.hhs.gov/sites/default/files/pdf/healthy-children-ready-learn.pdf cf.hhs.gov/policy/45-cfr-chap-xiii/1302-subpart-d-health-program-services •\tHealth Competencies https://eclkc.ohs.acf.hhs.gov/sites/default/files/pdf/health-competencies.pdf Non-ECLKC resources\t https://nrckids.org/CFOC/ https://ufhealth.org/well-child-visits#:~:text=15%20months,2%201%2F2%20years",117689' }])).toBe(false);
-    // eslint-disable-next-line no-useless-escape
-    expect(validateListOfResources([{ value: 'http:\lkj http:/test.v' }])).toBe(false);
-    expect(validateListOfResources([
-      { value: 'https://www.google.com' },
-      { value: 'not a valid url' },
-      { value: 'https://www.google.com' },
-    ])).toBe(false);
+  describe('validateListOfResources', () => {
+    it('returns false if there is an invalid resource', () => {
+      expect(validateListOfResources([{ value: 'http://www.test-domain.com/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain/long-domain/long/long/domain' }])).toBe(true);
+      expect(validateListOfResources([{ value: 'https://test.com' }])).toBe(true);
+      expect(validateListOfResources([{ value: 'http://test.com' }])).toBe(true);
+      expect(validateListOfResources([{ value: 'https://www.test.com' }])).toBe(true);
+      expect(validateListOfResources([{ value: 'http://www.test.com' }])).toBe(true);
+      expect(validateListOfResources([{ value: 'file://test.com' }])).toBe(false);
+      expect(validateListOfResources([{ value: 'http://test' }])).toBe(false);
+      expect(validateListOfResources([{ value: 'https://test' }])).toBe(false);
+      expect(validateListOfResources([{ value: 'http:mickeymouse.com' }])).toBe(false);
+      expect(validateListOfResources([{ value: 'http://google.comhttp://ask.comhttp://aol.com' }])).toBe(false);
+      expect(validateListOfResources([{ value: ' https://eclkc.ohs.acf.hhs.gov/sites/default/files/pdf/healthy-children-ready-learn.pdf cf.hhs.gov/policy/45-cfr-chap-xiii/1302-subpart-d-health-program-services •\tHealth Competencies https://eclkc.ohs.acf.hhs.gov/sites/default/files/pdf/health-competencies.pdf Non-ECLKC resources\t https://nrckids.org/CFOC/ https://ufhealth.org/well-child-visits#:~:text=15%20months,2%201%2F2%20years",117689' }])).toBe(false);
+      // eslint-disable-next-line no-useless-escape
+      expect(validateListOfResources([{ value: 'http:\lkj http:/test.v' }])).toBe(false);
+      expect(validateListOfResources([
+        { value: 'https://www.google.com' },
+        { value: 'not a valid url' },
+        { value: 'https://www.google.com' },
+      ])).toBe(false);
+    });
   });
-});
 
-test('grantsToSources function should return the correct source object', () => {
-  const grants = [
-    { numberWithProgramTypes: '123' },
-    { numberWithProgramTypes: '456' },
-    { numberWithProgramTypes: '789' },
-  ];
+  test('grantsToSources function should return the correct source object', () => {
+    const grants = [
+      { numberWithProgramTypes: '123' },
+      { numberWithProgramTypes: '456' },
+      { numberWithProgramTypes: '789' },
+    ];
+
+    const source = {
+      123: 'Source 1',
+      456: 'Source 2',
+      1234: 'Source 1',
+    };
 
-  const source = {
-    123: 'Source 1',
-    456: 'Source 2',
-    1234: 'Source 1',
-  };
+    const expected = {
+      123: 'Source 1',
+      456: 'Source 2',
+      789: '',
+    };
 
-  const expected = {
-    123: 'Source 1',
-    456: 'Source 2',
-    789: '',
-  };
+    const result = grantsToMultiValue(grants, source);
 
-  const result = grantsToMultiValue(grants, source);
+    expect(result).toEqual(expected);
+  });
+  describe('objectivesWithValidResourcesOnly', () => {
+    it('strips invalid resources', () => {
+      const objectives = [
+        {
+          resources: [
+            { value: 'https://www.google.com' },
+            { value: 'not a valid url' },
+            { value: 'https://www.google.com' },
+            { value: 'https://www.google.com ' },
+            { value: ' https://www.google.com' },
+          ],
+        },
+      ];
 
-  expect(result).toEqual(expected);
+      expect(objectivesWithValidResourcesOnly(objectives)).toEqual([
+        {
+          resources: [
+            { value: 'https://www.google.com' },
+            { value: 'https://www.google.com' },
+            { value: 'https://www.google.com' },
+            { value: 'https://www.google.com' },
+          ],
+        },
+      ]);
+    });
+  });
 });
diff --git a/frontend/src/components/GoalForm/constants.js b/frontend/src/components/GoalForm/constants.js
index de1565528d..3f10184645 100644
--- a/frontend/src/components/GoalForm/constants.js
+++ b/frontend/src/components/GoalForm/constants.js
@@ -1,22 +1,12 @@
 import React from 'react';
 import { v4 as uuidv4 } from 'uuid';
-import { DECIMAL_BASE } from '@ttahub/common';
+import { DECIMAL_BASE, DISALLOWED_URLS, isValidResourceUrl } from '@ttahub/common';
 import { uniq } from 'lodash';
 
-// regex to match a valid url, it must start with http:// or https://, have at least one dot, and not end with a dot or a space
-const VALID_URL_REGEX = /^https?:\/\/.*\.[^ |^.]/;
-
-export const isValidResourceUrl = (attempted) => {
-  try {
-    const httpOccurences = (attempted.match(/http/gi) || []).length;
-    if (httpOccurences !== 1 || !VALID_URL_REGEX.test(attempted)) {
-      return false;
-    }
-    const u = new URL(attempted);
-    return (u !== '');
-  } catch (e) {
-    return false;
-  }
+export const noDisallowedUrls = (value) => {
+  const urls = value.map((v) => v.value);
+  const disallowedUrl = DISALLOWED_URLS.find((disallowed) => urls.includes(disallowed.url));
+  return disallowedUrl ? disallowedUrl.error : true;
 };
 
 export const objectivesWithValidResourcesOnly = (objectives) => {
diff --git a/frontend/src/pages/ActivityReport/Pages/components/Objective.js b/frontend/src/pages/ActivityReport/Pages/components/Objective.js
index 368e939a2e..5a9399919a 100644
--- a/frontend/src/pages/ActivityReport/Pages/components/Objective.js
+++ b/frontend/src/pages/ActivityReport/Pages/components/Objective.js
@@ -18,11 +18,10 @@ import { OBJECTIVE_PROP, NO_ERROR, ERROR_FORMAT } from './constants';
 import { uploadObjectivesFile } from '../../../../fetchers/File';
 import {
   OBJECTIVE_TITLE,
-  OBJECTIVE_RESOURCES,
   OBJECTIVE_TTA,
   OBJECTIVE_TOPICS,
 } from './goalValidator';
-import { validateListOfResources } from '../../../../components/GoalForm/constants';
+import { validateListOfResources, noDisallowedUrls } from '../../../../components/GoalForm/constants';
 import AppLoadingContext from '../../../../AppLoadingContext';
 import './Objective.scss';
 import ObjectiveSuspendModal from '../../../../components/ObjectiveSuspendModal';
@@ -112,7 +111,8 @@ export default function Objective({
     name: `${fieldArrayName}[${index}].resources`,
     rules: {
       validate: {
-        allResourcesAreValid: (value) => validateListOfResources(value) || OBJECTIVE_RESOURCES,
+        noDisallowedUrls,
+        allResourcesAreValid: (value) => validateListOfResources(value) || 'Enter one resource per field. Valid resource links must start with http:// or https://',
       },
     },
     defaultValue: objective.resources,
diff --git a/frontend/src/pages/SessionForm/components/SessionObjectiveResource.js b/frontend/src/pages/SessionForm/components/SessionObjectiveResource.js
index a7583df58c..a1c7390f85 100644
--- a/frontend/src/pages/SessionForm/components/SessionObjectiveResource.js
+++ b/frontend/src/pages/SessionForm/components/SessionObjectiveResource.js
@@ -1,5 +1,6 @@
 import React from 'react';
 import PropTypes from 'prop-types';
+import { isValidResourceUrl } from '@ttahub/common';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 import { faTrash } from '@fortawesome/free-solid-svg-icons';
 import { useFormContext } from 'react-hook-form';
@@ -12,7 +13,7 @@ import {
   FormGroup,
 } from '@trussworks/react-uswds';
 import colors from '../../../colors';
-import { isValidResourceUrl } from '../../../components/GoalForm/constants';
+import { noDisallowedUrls } from '../../../components/GoalForm/constants';
 import './SessionObjectiveResource.scss';
 
 export default function SessionObjectiveResource({
@@ -46,6 +47,7 @@ export default function SessionObjectiveResource({
             validate: {
               isValidResourceUrl: (value) => {
                 if (!value) return true;
+                if (noDisallowedUrls([{ value }]) !== true) return noDisallowedUrls([{ value }]);
                 return isValidResourceUrl(value) || 'Please enter a valid URL';
               },
             },
diff --git a/frontend/src/pages/SessionForm/index.js b/frontend/src/pages/SessionForm/index.js
index 73357201d0..52e322f395 100644
--- a/frontend/src/pages/SessionForm/index.js
+++ b/frontend/src/pages/SessionForm/index.js
@@ -10,7 +10,7 @@ import { Helmet } from 'react-helmet';
 import { Alert, Grid } from '@trussworks/react-uswds';
 import { useHistory, Redirect } from 'react-router-dom';
 import { FormProvider, useForm } from 'react-hook-form';
-import { TRAINING_REPORT_STATUSES } from '@ttahub/common';
+import { TRAINING_REPORT_STATUSES, isValidResourceUrl } from '@ttahub/common';
 import useSocket, { usePublishWebsocketLocationOnInterval } from '../../hooks/useSocket';
 import useHookFormPageState from '../../hooks/useHookFormPageState';
 import { defaultValues } from './constants';
@@ -21,7 +21,6 @@ import Navigator from '../../components/Navigator';
 import BackLink from '../../components/BackLink';
 import pages from './pages';
 import AppLoadingContext from '../../AppLoadingContext';
-import { isValidResourceUrl } from '../../components/GoalForm/constants';
 
 // websocket publish location interval
 const INTERVAL_DELAY = 10000; // TEN SECONDS
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index 7f08389540..1a68234473 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -2373,10 +2373,10 @@
   resolved "https://registry.yarnpkg.com/@trysound/sax/-/sax-0.2.0.tgz#cccaab758af56761eb7bf37af6f03f326dd798ad"
   integrity sha512-L7z9BgrNEcYyUYtF+HaEfiS5ebkh9jXqbszz7pC0hRBPaatV0XjSD3+eHrpqFemQfgwiFF0QPIarnIihIDn7OA==
 
-"@ttahub/common@^2.1.3":
-  version "2.1.3"
-  resolved "https://registry.yarnpkg.com/@ttahub/common/-/common-2.1.3.tgz#56fa179bec3525d7bd322907e25fa123e30f4b7d"
-  integrity sha512-HwzTa0t4a7sFG9N4qOo3HkrWPFZVYrYFJf/dRwRuFze/+o36B9oXaz+TY7Aqj30An6I1njKdytYPnWNIaSQf7w==
+"@ttahub/common@^2.1.5":
+  version "2.1.5"
+  resolved "https://registry.yarnpkg.com/@ttahub/common/-/common-2.1.5.tgz#1e9550c507a6e4422eae72a923eed7c18613e827"
+  integrity sha512-fy2jgE7xdaifZsxF+uiqwGpsxa0UchjPUNI2BI84Rw72FiTAglpkfn4wy4yO82NW7PyIa9CbICa4sP+XcKwKMg==
 
 "@turf/area@^6.4.0":
   version "6.5.0"
diff --git a/package.json b/package.json
index 7857d3fcc7..0fbbab4ca3 100644
--- a/package.json
+++ b/package.json
@@ -300,7 +300,7 @@
     "@elastic/elasticsearch-mock": "^2.0.0",
     "@faker-js/faker": "^6.0.0",
     "@opensearch-project/opensearch": "^1.1.0",
-    "@ttahub/common": "^2.1.3",
+    "@ttahub/common": "^2.1.5",
     "adm-zip": "^0.5.1",
     "aws-sdk": "^2.826.0",
     "aws4": "^1.11.0",
@@ -358,7 +358,7 @@
     "validator": "^13.7.0",
     "wait-for-expect": "^3.0.2",
     "winston": "^3.3.3",
-    "ws": "^8.5.0",
+    "ws": "^8.17.1",
     "xml2json": "^0.12.0",
     "yargs": "^17.3.1",
     "yayson": "^2.1.0"
diff --git a/packages/common/package.json b/packages/common/package.json
index 50743557b8..54c8ba6aff 100644
--- a/packages/common/package.json
+++ b/packages/common/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@ttahub/common",
-    "version": "2.1.3",
+    "version": "2.1.5",
     "description": "The purpose of this package is to reduce code duplication between the frontend and backend projects.",
     "main": "src/index.js",
     "author": "",
diff --git a/packages/common/src/constants.js b/packages/common/src/constants.js
index e763864458..cedb48745b 100644
--- a/packages/common/src/constants.js
+++ b/packages/common/src/constants.js
@@ -364,3 +364,20 @@ const REOPEN_REASONS = {
 };
 
 exports.REOPEN_REASONS = REOPEN_REASONS;
+
+const DISALLOWED_URLS = [{
+  url: 'https://eclkc.ohs.acf.hhs.gov/professional-development/individualized-professional-development-ipd-portfolio/course-catalog',
+  error: 'This link is no longer accepted in this field. Enter iPD courses used during your TTA session in the other field in this section.',
+}, {
+  url: 'https://eclkc.ohs.acf.hhs.gov/professional-development/individualized-professional-development-ipd-portfolio/individualized-professional-development-ipd-portfolio',
+  error: 'This link is no longer accepted in this field. Enter iPD courses used during your TTA session in the other field in this section.',
+}, {
+  url: 'https://eclkc.ohs.acf.hhs.gov/cas/login',
+  error: 'This link is no longer accepted in this field. Enter iPD courses used during your TTA session in the other field in this section.',
+}];
+
+exports.DISALLOWED_URLS = DISALLOWED_URLS;
+
+const VALID_URL_REGEX = /(?<url>(?<scheme>http(?:s)?):\/\/(?:(?<user>[a-zA-Z0-9._]+)(?:[:](?<password>[a-zA-Z0-9%._\+~#=]+))?[@])?(?:(?:www\.)?(?<host>[-a-zA-Z0-9%._\+~#=]{1,}\.[a-z]{2,6})|(?<ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3}))(?:[:](?<port>[0-9]+))?(?:[\/](?<path>[-a-zA-Z0-9'@:%_\+.,~#&\/=()]*[-a-zA-Z0-9@:%_\+.~#&\/=()])?)?(?:[?](?<query>[-a-zA-Z0-9@:%_\+.~#&\/=()]*))*)/ig;
+exports.VALID_URL_REGEX = VALID_URL_REGEX;
+
diff --git a/packages/common/src/utils.js b/packages/common/src/utils.js
index 24b27a71b2..0e7782aa94 100644
--- a/packages/common/src/utils.js
+++ b/packages/common/src/utils.js
@@ -1,4 +1,27 @@
-const { GOAL_STATUS } = require('./constants');
+const { GOAL_STATUS, DISALLOWED_URLS, VALID_URL_REGEX } = require('./constants');
+
+function isValidResourceUrl(attempted) {
+  try {
+    const httpOccurences = (attempted.match(/http/gi) || []).length;
+    if (
+      httpOccurences !== 1
+      || DISALLOWED_URLS.some((disallowed) => disallowed.url === attempted)
+    ) {
+      return false;
+    }
+
+    const matches = [...attempted.matchAll(VALID_URL_REGEX)].map(({ groups }) => groups);
+
+    if (matches?.length !== 1) {
+      return false;
+    }
+
+    const u = new URL(attempted);
+    return (u !== '');
+  } catch (e) {
+    return false;
+  }
+};
 
 /**
  * Given a list of goal statuses, determine the final status
@@ -31,5 +54,6 @@ function determineMergeGoalStatus(statuses) {
 }
 
 module.exports = {
-  determineMergeGoalStatus
+  determineMergeGoalStatus,
+  isValidResourceUrl,
 }
\ No newline at end of file
diff --git a/src/lib/urlUtils.js b/src/lib/urlUtils.js
deleted file mode 100644
index 73f4084fff..0000000000
--- a/src/lib/urlUtils.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/* eslint-disable import/prefer-default-export */
-/* eslint-disable no-useless-escape */
-// regex to match a valid url, it must start with http:// or https://, have at least one dot, and not end with a dot or a space
-export const VALID_URL_REGEX = /(?<url>(?<scheme>http(?:s)?):\/\/(?:(?<user>[a-zA-Z0-9._]+)(?:[:](?<password>[a-zA-Z0-9%._\+~#=]+))?[@])?(?:(?:www\.)?(?<host>[-a-zA-Z0-9%._\+~#=]{1,}\.[a-z]{2,6})|(?<ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3}))(?:[:](?<port>[0-9]+))?(?:[\/](?<path>[-a-zA-Z0-9'@:%_\+.,~#&\/=()]*[-a-zA-Z0-9@:%_\+.~#&\/=()])?)?(?:[?](?<query>[-a-zA-Z0-9@:%_\+.~#&\/=()]*))*)/ig;
-
-// regex and function copied from frontend (they should match)
-export const isValidResourceUrl = (input) => {
-  try {
-    const matches = [...input.matchAll(VALID_URL_REGEX)].map(({ groups }) => groups);
-    if (matches?.length !== 1) {
-      return false;
-    }
-    const u = new URL(matches[0].url);
-    return (u !== '');
-  } catch (e) {
-    return false;
-  }
-};
diff --git a/src/lib/urlUtils.test.js b/src/lib/urlUtils.test.js
index 6c27a05080..e3d73d0b56 100644
--- a/src/lib/urlUtils.test.js
+++ b/src/lib/urlUtils.test.js
@@ -1,4 +1,4 @@
-import { isValidResourceUrl } from './urlUtils';
+import { isValidResourceUrl } from '@ttahub/common';
 
 describe('urlUtils', () => {
   describe('isValidResourceUrl', () => {
@@ -22,6 +22,9 @@ describe('urlUtils', () => {
       'http://google.comhttp://ask.comhttp://aol.com',
       // eslint-disable-next-line no-useless-escape
       'http:\lkj http:/test.v',
+      'https://eclkc.ohs.acf.hhs.gov/professional-development/individualized-professional-development-ipd-portfolio/individualized-professional-development-ipd-portfolio',
+      'https://eclkc.ohs.acf.hhs.gov/cas/login',
+      'https://eclkc.ohs.acf.hhs.gov/professional-development/individualized-professional-development-ipd-portfolio/course-catalog',
     ];
 
     it('correctly validates resources', () => {
diff --git a/src/models/hooks/resource.js b/src/models/hooks/resource.js
index 12b2cf4d4e..a7dd8c4d9c 100644
--- a/src/models/hooks/resource.js
+++ b/src/models/hooks/resource.js
@@ -1,4 +1,4 @@
-import { VALID_URL_REGEX } from '../../lib/urlUtils';
+const { VALID_URL_REGEX } = require('@ttahub/common');
 
 const autoPopulateDomain = (sequelize, instance, options) => {
   // eslint-disable-next-line no-prototype-builtins
diff --git a/src/services/resource.js b/src/services/resource.js
index 02f8421c30..2ea5b3a136 100644
--- a/src/services/resource.js
+++ b/src/services/resource.js
@@ -1,4 +1,5 @@
 import { Op } from 'sequelize';
+import { VALID_URL_REGEX } from '@ttahub/common';
 import {
   ActivityReport,
   ActivityReportResource,
@@ -14,7 +15,6 @@ import {
   NextStepResource,
   Resource,
 } from '../models';
-import { VALID_URL_REGEX } from '../lib/urlUtils';
 import { SOURCE_FIELD } from '../constants';
 import Semaphore from '../lib/semaphore';
 
diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues
index 7e826b2e11..ff11481921 100644
--- a/yarn-audit-known-issues
+++ b/yarn-audit-known-issues
@@ -3,9 +3,6 @@
 {"type":"auditAdvisory","data":{"resolution":{"id":1097109,"path":"@elastic/elasticsearch>@elastic/transport>undici","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"5.19.1","paths":["@elastic/elasticsearch>@elastic/transport>undici"]}],"metadata":null,"vulnerable_versions":"<5.28.4","module_name":"undici","severity":"low","github_advisory_id":"GHSA-m4v8-wqvr-p9f7","cves":["CVE-2024-30260"],"access":"public","patched_versions":">=5.28.4","cvss":{"score":3.9,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},"updated":"2024-04-20T00:31:53.000Z","recommendation":"Upgrade to version 5.28.4 or later","cwe":["CWE-200","CWE-285"],"found_by":null,"deleted":null,"id":1097109,"references":"- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7\n- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f\n- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75\n- https://hackerone.com/reports/2408074\n- https://nvd.nist.gov/vuln/detail/CVE-2024-30260\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E\n- https://github.com/advisories/GHSA-m4v8-wqvr-p9f7","created":"2024-04-04T14:20:39.000Z","reported_by":null,"title":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","npm_advisory_id":null,"overview":"### Impact\n\nUndici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`.\n\n### Patches\n\nThis has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75.\nFixes has been released in v5.28.4 and v6.11.1.\n\n### Workarounds\n\nuse `fetch()` or disable `maxRedirections`.\n\n### References\n\nLinzi Shang reported this.\n\n* https://hackerone.com/reports/2408074\n* https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3\n","url":"https://github.com/advisories/GHSA-m4v8-wqvr-p9f7"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1097200,"path":"@elastic/elasticsearch>@elastic/transport>undici","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"5.19.1","paths":["@elastic/elasticsearch>@elastic/transport>undici"]}],"metadata":null,"vulnerable_versions":"<5.28.4","module_name":"undici","severity":"low","github_advisory_id":"GHSA-9qxr-qj54-h672","cves":["CVE-2024-30261"],"access":"public","patched_versions":">=5.28.4","cvss":{"score":2.6,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"},"updated":"2024-04-29T05:02:11.000Z","recommendation":"Upgrade to version 5.28.4 or later","cwe":["CWE-284"],"found_by":null,"deleted":null,"id":1097200,"references":"- https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672\n- https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055\n- https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3\n- https://hackerone.com/reports/2377760\n- https://nvd.nist.gov/vuln/detail/CVE-2024-30261\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E\n- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ\n- https://github.com/advisories/GHSA-9qxr-qj54-h672","created":"2024-04-04T14:20:54.000Z","reported_by":null,"title":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","npm_advisory_id":null,"overview":"### Impact\n\nIf an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been tampered.\n\n### Patches\n\nFixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3.\nFixes has been released in v5.28.4 and v6.11.1.\n\n\n### Workarounds\n\nEnsure that `integrity` cannot be tampered with.\n\n### References\n\nhttps://hackerone.com/reports/2377760\n","url":"https://github.com/advisories/GHSA-9qxr-qj54-h672"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1097221,"path":"@elastic/elasticsearch>@elastic/transport>undici","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"5.19.1","paths":["@elastic/elasticsearch>@elastic/transport>undici"]}],"metadata":null,"vulnerable_versions":"<=5.28.2","module_name":"undici","severity":"low","github_advisory_id":"GHSA-3787-6prv-h9w3","cves":["CVE-2024-24758"],"access":"public","patched_versions":">=5.28.3","cvss":{"score":3.9,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},"updated":"2024-05-02T13:15:07.000Z","recommendation":"Upgrade to version 5.28.3 or later","cwe":["CWE-200"],"found_by":null,"deleted":null,"id":1097221,"references":"- https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3\n- https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef\n- https://github.com/nodejs/undici/commit/d3aa574b1259c1d8d329a0f0f495ee82882b1458\n- https://github.com/nodejs/undici/releases/tag/v5.28.3\n- https://github.com/nodejs/undici/releases/tag/v6.6.1\n- https://nvd.nist.gov/vuln/detail/CVE-2024-24758\n- https://security.netapp.com/advisory/ntap-20240419-0007\n- http://www.openwall.com/lists/oss-security/2024/03/11/1\n- https://github.com/advisories/GHSA-3787-6prv-h9w3","created":"2024-02-16T16:02:52.000Z","reported_by":null,"title":"Undici proxy-authorization header not cleared on cross-origin redirect in fetch","npm_advisory_id":null,"overview":"### Impact\n\nUndici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authorization` headers. \n\n### Patches\n\nThis is patched in v5.28.3 and v6.6.1\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n- https://fetch.spec.whatwg.org/#authentication-entries\n- https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","url":"https://github.com/advisories/GHSA-3787-6prv-h9w3"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":1097615,"path":"jsdom>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.16.0","paths":["jsdom>ws"]},{"version":"8.14.2","paths":["newrelic>@newrelic/security-agent>ws"]},{"version":"8.5.0","paths":["ws"]}],"metadata":null,"vulnerable_versions":">=8.0.0 <8.17.1","module_name":"ws","severity":"high","github_advisory_id":"GHSA-3h5v-q93c-6h6q","cves":["CVE-2024-37890"],"access":"public","patched_versions":">=8.17.1","cvss":{"score":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"updated":"2024-06-17T19:09:12.000Z","recommendation":"Upgrade to version 8.17.1 or later","cwe":["CWE-476"],"found_by":null,"deleted":null,"id":1097615,"references":"- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f\n- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e\n- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c\n- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63\n- https://github.com/advisories/GHSA-3h5v-q93c-6h6q","created":"2024-06-17T19:09:10.000Z","reported_by":null,"title":"ws affected by a DoS when handling a request with many HTTP headers","npm_advisory_id":null,"overview":"### Impact\n\nA request with a number of headers exceeding the[`server.maxHeadersCount`][] threshold could be used to crash a ws server.\n\n### Proof of concept\n\n```js\nconst http = require('http');\nconst WebSocket = require('ws');\n\nconst wss = new WebSocket.Server({ port: 0 }, function () {\n  const chars = \"!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~\".split('');\n  const headers = {};\n  let count = 0;\n\n  for (let i = 0; i < chars.length; i++) {\n    if (count === 2000) break;\n\n    for (let j = 0; j < chars.length; j++) {\n      const key = chars[i] + chars[j];\n      headers[key] = 'x';\n\n      if (++count === 2000) break;\n    }\n  }\n\n  headers.Connection = 'Upgrade';\n  headers.Upgrade = 'websocket';\n  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';\n  headers['Sec-WebSocket-Version'] = '13';\n\n  const request = http.request({\n    headers: headers,\n    host: '127.0.0.1',\n    port: wss.address().port\n  });\n\n  request.end();\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e)\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated in the following ways:\n\n1. Reduce the maximum allowed length of the request headers using the [`--max-http-header-size=size`][] and/or the [`maxHeaderSize`][] options so that no more headers than the `server.maxHeadersCount` limit can be sent.\n2. Set `server.maxHeadersCount` to `0` so that no limit is applied.\n\n### Credits\n\nThe vulnerability was reported by [Ryan LaPointe](https://github.com/rrlapointe) in https://github.com/websockets/ws/issues/2230.\n\n### References\n\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n\n[`--max-http-header-size=size`]: https://nodejs.org/api/cli.html#--max-http-header-sizesize\n[`maxHeaderSize`]: https://nodejs.org/api/http.html#httpcreateserveroptions-requestlistener\n[`server.maxHeadersCount`]: https://nodejs.org/api/http.html#servermaxheaderscount\n","url":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":1097615,"path":"newrelic>@newrelic/security-agent>ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.16.0","paths":["jsdom>ws"]},{"version":"8.14.2","paths":["newrelic>@newrelic/security-agent>ws"]},{"version":"8.5.0","paths":["ws"]}],"metadata":null,"vulnerable_versions":">=8.0.0 <8.17.1","module_name":"ws","severity":"high","github_advisory_id":"GHSA-3h5v-q93c-6h6q","cves":["CVE-2024-37890"],"access":"public","patched_versions":">=8.17.1","cvss":{"score":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"updated":"2024-06-17T19:09:12.000Z","recommendation":"Upgrade to version 8.17.1 or later","cwe":["CWE-476"],"found_by":null,"deleted":null,"id":1097615,"references":"- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f\n- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e\n- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c\n- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63\n- https://github.com/advisories/GHSA-3h5v-q93c-6h6q","created":"2024-06-17T19:09:10.000Z","reported_by":null,"title":"ws affected by a DoS when handling a request with many HTTP headers","npm_advisory_id":null,"overview":"### Impact\n\nA request with a number of headers exceeding the[`server.maxHeadersCount`][] threshold could be used to crash a ws server.\n\n### Proof of concept\n\n```js\nconst http = require('http');\nconst WebSocket = require('ws');\n\nconst wss = new WebSocket.Server({ port: 0 }, function () {\n  const chars = \"!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~\".split('');\n  const headers = {};\n  let count = 0;\n\n  for (let i = 0; i < chars.length; i++) {\n    if (count === 2000) break;\n\n    for (let j = 0; j < chars.length; j++) {\n      const key = chars[i] + chars[j];\n      headers[key] = 'x';\n\n      if (++count === 2000) break;\n    }\n  }\n\n  headers.Connection = 'Upgrade';\n  headers.Upgrade = 'websocket';\n  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';\n  headers['Sec-WebSocket-Version'] = '13';\n\n  const request = http.request({\n    headers: headers,\n    host: '127.0.0.1',\n    port: wss.address().port\n  });\n\n  request.end();\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e)\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated in the following ways:\n\n1. Reduce the maximum allowed length of the request headers using the [`--max-http-header-size=size`][] and/or the [`maxHeaderSize`][] options so that no more headers than the `server.maxHeadersCount` limit can be sent.\n2. Set `server.maxHeadersCount` to `0` so that no limit is applied.\n\n### Credits\n\nThe vulnerability was reported by [Ryan LaPointe](https://github.com/rrlapointe) in https://github.com/websockets/ws/issues/2230.\n\n### References\n\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n\n[`--max-http-header-size=size`]: https://nodejs.org/api/cli.html#--max-http-header-sizesize\n[`maxHeaderSize`]: https://nodejs.org/api/http.html#httpcreateserveroptions-requestlistener\n[`server.maxHeadersCount`]: https://nodejs.org/api/http.html#servermaxheaderscount\n","url":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q"}}}
-{"type":"auditAdvisory","data":{"resolution":{"id":1097615,"path":"ws","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.16.0","paths":["jsdom>ws"]},{"version":"8.14.2","paths":["newrelic>@newrelic/security-agent>ws"]},{"version":"8.5.0","paths":["ws"]}],"metadata":null,"vulnerable_versions":">=8.0.0 <8.17.1","module_name":"ws","severity":"high","github_advisory_id":"GHSA-3h5v-q93c-6h6q","cves":["CVE-2024-37890"],"access":"public","patched_versions":">=8.17.1","cvss":{"score":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"updated":"2024-06-17T19:09:12.000Z","recommendation":"Upgrade to version 8.17.1 or later","cwe":["CWE-476"],"found_by":null,"deleted":null,"id":1097615,"references":"- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f\n- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e\n- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c\n- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63\n- https://github.com/advisories/GHSA-3h5v-q93c-6h6q","created":"2024-06-17T19:09:10.000Z","reported_by":null,"title":"ws affected by a DoS when handling a request with many HTTP headers","npm_advisory_id":null,"overview":"### Impact\n\nA request with a number of headers exceeding the[`server.maxHeadersCount`][] threshold could be used to crash a ws server.\n\n### Proof of concept\n\n```js\nconst http = require('http');\nconst WebSocket = require('ws');\n\nconst wss = new WebSocket.Server({ port: 0 }, function () {\n  const chars = \"!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~\".split('');\n  const headers = {};\n  let count = 0;\n\n  for (let i = 0; i < chars.length; i++) {\n    if (count === 2000) break;\n\n    for (let j = 0; j < chars.length; j++) {\n      const key = chars[i] + chars[j];\n      headers[key] = 'x';\n\n      if (++count === 2000) break;\n    }\n  }\n\n  headers.Connection = 'Upgrade';\n  headers.Upgrade = 'websocket';\n  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';\n  headers['Sec-WebSocket-Version'] = '13';\n\n  const request = http.request({\n    headers: headers,\n    host: '127.0.0.1',\n    port: wss.address().port\n  });\n\n  request.end();\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e)\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated in the following ways:\n\n1. Reduce the maximum allowed length of the request headers using the [`--max-http-header-size=size`][] and/or the [`maxHeaderSize`][] options so that no more headers than the `server.maxHeadersCount` limit can be sent.\n2. Set `server.maxHeadersCount` to `0` so that no limit is applied.\n\n### Credits\n\nThe vulnerability was reported by [Ryan LaPointe](https://github.com/rrlapointe) in https://github.com/websockets/ws/issues/2230.\n\n### References\n\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n\n[`--max-http-header-size=size`]: https://nodejs.org/api/cli.html#--max-http-header-sizesize\n[`maxHeaderSize`]: https://nodejs.org/api/http.html#httpcreateserveroptions-requestlistener\n[`server.maxHeadersCount`]: https://nodejs.org/api/http.html#servermaxheaderscount\n","url":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1096410,"path":"xml2json>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"4.2.1","paths":["xml2json>hoek"]},{"version":"5.0.4","paths":["xml2json>joi>hoek"]},{"version":"6.1.3","paths":["xml2json>joi>topo>hoek"]}],"metadata":null,"vulnerable_versions":"<=6.1.3","module_name":"hoek","severity":"high","github_advisory_id":"GHSA-c429-5p7v-vgjp","cves":["CVE-2020-36604"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":8.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"updated":"2024-02-07T18:59:37.000Z","recommendation":"None","cwe":["CWE-1321"],"found_by":null,"deleted":null,"id":1096410,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2020-36604\n- https://github.com/hapijs/hoek/issues/352\n- https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a\n- https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90\n- https://github.com/advisories/GHSA-c429-5p7v-vgjp","created":"2022-09-25T00:00:27.000Z","reported_by":null,"title":"hoek subject to prototype pollution via the clone function.","npm_advisory_id":null,"overview":"hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the __proto__ key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1. ","url":"https://github.com/advisories/GHSA-c429-5p7v-vgjp"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1096410,"path":"xml2json>joi>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"4.2.1","paths":["xml2json>hoek"]},{"version":"5.0.4","paths":["xml2json>joi>hoek"]},{"version":"6.1.3","paths":["xml2json>joi>topo>hoek"]}],"metadata":null,"vulnerable_versions":"<=6.1.3","module_name":"hoek","severity":"high","github_advisory_id":"GHSA-c429-5p7v-vgjp","cves":["CVE-2020-36604"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":8.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"updated":"2024-02-07T18:59:37.000Z","recommendation":"None","cwe":["CWE-1321"],"found_by":null,"deleted":null,"id":1096410,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2020-36604\n- https://github.com/hapijs/hoek/issues/352\n- https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a\n- https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90\n- https://github.com/advisories/GHSA-c429-5p7v-vgjp","created":"2022-09-25T00:00:27.000Z","reported_by":null,"title":"hoek subject to prototype pollution via the clone function.","npm_advisory_id":null,"overview":"hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the __proto__ key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1. ","url":"https://github.com/advisories/GHSA-c429-5p7v-vgjp"}}}
 {"type":"auditAdvisory","data":{"resolution":{"id":1096410,"path":"xml2json>joi>topo>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"4.2.1","paths":["xml2json>hoek"]},{"version":"5.0.4","paths":["xml2json>joi>hoek"]},{"version":"6.1.3","paths":["xml2json>joi>topo>hoek"]}],"metadata":null,"vulnerable_versions":"<=6.1.3","module_name":"hoek","severity":"high","github_advisory_id":"GHSA-c429-5p7v-vgjp","cves":["CVE-2020-36604"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":8.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"updated":"2024-02-07T18:59:37.000Z","recommendation":"None","cwe":["CWE-1321"],"found_by":null,"deleted":null,"id":1096410,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2020-36604\n- https://github.com/hapijs/hoek/issues/352\n- https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a\n- https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90\n- https://github.com/advisories/GHSA-c429-5p7v-vgjp","created":"2022-09-25T00:00:27.000Z","reported_by":null,"title":"hoek subject to prototype pollution via the clone function.","npm_advisory_id":null,"overview":"hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the __proto__ key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1. ","url":"https://github.com/advisories/GHSA-c429-5p7v-vgjp"}}}
diff --git a/yarn.lock b/yarn.lock
index 855ff743f5..ad88a2d527 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3275,10 +3275,10 @@
   resolved "https://registry.yarnpkg.com/@tootallnate/once/-/once-1.1.2.tgz#ccb91445360179a04e7fe6aff78c00ffc1eeaf82"
   integrity sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==
 
-"@ttahub/common@^2.1.3":
-  version "2.1.3"
-  resolved "https://registry.yarnpkg.com/@ttahub/common/-/common-2.1.3.tgz#56fa179bec3525d7bd322907e25fa123e30f4b7d"
-  integrity sha512-HwzTa0t4a7sFG9N4qOo3HkrWPFZVYrYFJf/dRwRuFze/+o36B9oXaz+TY7Aqj30An6I1njKdytYPnWNIaSQf7w==
+"@ttahub/common@^2.1.5":
+  version "2.1.5"
+  resolved "https://registry.yarnpkg.com/@ttahub/common/-/common-2.1.5.tgz#1e9550c507a6e4422eae72a923eed7c18613e827"
+  integrity sha512-fy2jgE7xdaifZsxF+uiqwGpsxa0UchjPUNI2BI84Rw72FiTAglpkfn4wy4yO82NW7PyIa9CbICa4sP+XcKwKMg==
 
 "@types/argparse@1.0.38":
   version "1.0.38"
@@ -14038,31 +14038,21 @@ write-file-atomic@^3.0.0:
     signal-exit "^3.0.2"
     typedarray-to-buffer "^3.1.5"
 
-ws@8.5.0, ws@^8.5.0:
+ws@8.5.0:
   version "8.5.0"
   resolved "https://registry.yarnpkg.com/ws/-/ws-8.5.0.tgz#bfb4be96600757fe5382de12c670dab984a1ed4f"
   integrity sha512-BWX0SWVgLPzYwF8lTzEy1egjhS4S4OEAHfsO8o65WOVsrnSRGaSiUaa9e0ggGlkMTtBlmOpEXiie9RUcBO86qg==
 
-ws@>=8.7.0:
-  version "8.9.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.9.0.tgz#2a994bb67144be1b53fe2d23c53c028adeb7f45e"
-  integrity sha512-Ja7nszREasGaYUYCI2k4lCKIRTt+y7XuqVoHR44YpI49TtryyqbqvDMn5eqfW7e6HzTukDRIsXqzVHScqRcafg==
+ws@>=8.7.0, ws@^8.14.2, ws@^8.16.0, ws@^8.17.1:
+  version "8.17.1"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.17.1.tgz#9293da530bb548febc95371d90f9c878727d919b"
+  integrity sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ==
 
 ws@^7.4.6:
   version "7.5.9"
   resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.9.tgz#54fa7db29f4c7cec68b1ddd3a89de099942bb591"
   integrity sha512-F+P9Jil7UiSKSkppIiD94dN07AwvFixvLIj1Og1Rl9GGMuNipJnV9JzjD6XuqmAeiswGvUmNLjr5cFuXwNS77Q==
 
-ws@^8.14.2:
-  version "8.14.2"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.14.2.tgz#6c249a806eb2db7a20d26d51e7709eab7b2e6c7f"
-  integrity sha512-wEBG1ftX4jcglPxgFCMJmZ2PLtSbJ2Peg6TmpJFTbe9GZYOQCDPdMYu/Tm0/bGZkw8paZnJY45J4K2PZrLYq8g==
-
-ws@^8.16.0:
-  version "8.16.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.16.0.tgz#d1cd774f36fbc07165066a60e40323eab6446fd4"
-  integrity sha512-HS0c//TP7Ina87TfiPUz1rQzMhHrl/SG2guqRcTOIUYD2q8uhUdNHZYJUaQ8aTGPzCh+c6oawMKW35nFl1dxyQ==
-
 xdg-basedir@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/xdg-basedir/-/xdg-basedir-4.0.0.tgz#4bc8d9984403696225ef83a1573cbbcb4e79db13"
@@ -14239,4 +14229,4 @@ yayson@^2.1.0:
   optionalDependencies:
     lodash "^4.17.21"
     q "^1.5.1"
-    underscore "^1.13.1"
\ No newline at end of file
+    underscore "^1.13.1"