Bump ws, web3, @oasisprotocol/sapphire-paratime and ethers

[dependabot]

Bumps ws to 8.21.3 and updates ancestor dependencies ws, web3, @oasisprotocol/sapphire-paratime and ethers. These dependencies need to be updated together.

Updates ws from 8.20.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates web3 from 1.10.4 to 4.16.0

Release notes

Sourced from web3's releases.

web3-eth@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-eth@4.0.0-alpha.0

web3-core-requestmanager@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-core-requestmanager@4.0.0-alpha.0

web3-providers-http@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-providers-http@4.0.0-alpha.0

web3-providers-base@1.0.0-alpha.1

Changed

• Update version to 1.0.0-alpha.1 for web3-providers-base
• Update version to 4.0.0-alpha.0 for web3-utils in web3-providers-base

web3-utils@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-utils@4.0.0-alpha.0

web3-packagetemplate@1.0.0-alpha.0

Initial alpha release

Install with yarn add web3-packagetemplate@1.0.0-alpha.0

Changelog

Sourced from web3's changelog.

[4.16.0]

Fixed

web3

• Export Web3Account, Wallet and signature related types. (#7374)

web3-utils

• Make fromWei return "0" when input is 0 (#7387)

Removed

web3-eth-accounts

• Move signature related types to web3-types. Re-export them for backwards compatibility. (#7374)

Added

web3-types

• Add signature related types. (#7374)
• Updated Typescript version 4 -> 5 (#7272)

web3-eth-accounts

• Updated Typescript version 4 -> 5 (#7272)

web3

• Updated Typescript version 4 -> 5 (#7272)

web3-core

• Updated Typescript version 4 -> 5 (#7272)

web3-account-abstraction

• RC release

web3-errors

• Updated Typescript version 4 -> 5 (#7272)

web3-eth

• Updated Typescript version 4 -> 5 (#7272)

web3-eth-contract

... (truncated)

Commits

• aa197b8 add typescript and version bump to changelogs
• 82ceab7 update web3-types
• 2b7cf1c v4.16.0 release
• 926044b chore(deps-dev): bump http-proxy-middleware from 2.0.6 to 2.0.7 (#7407)
• 7a8df69 update typescript version to 5 (#7272)
• 984cb7c chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 (#7404)
• 3b122a2 fix: upgrade @​cookbookdev/docsbot from 4.24.0 to 4.24.4 (#7403)
• 56d4aec Replaces #7390, #7391, & #7400 (#7401)
• 6379aa8 fix: remove force exit from blackbox tests (#7397)
• 5437fbc fix: upgrade @​mdx-js/react from 3.0.1 to 3.1.0 (#7395)
• Additional commits viewable in compare view

Updates @oasisprotocol/sapphire-paratime from 1.3.2 to 2.3.0

Commits

• 39855d3 Merge pull request #661 from oasisprotocol/matevz/feature/clients-js-2.3.0
• db50225 clients-js: Prepare 2.3.0 release
• 83ff6e8 Merge pull request #656 from oasisprotocol/matevz/feature/wagmi-v2-2.2.0
• bb0f704 integrations/wagmi-v2: Prepare 3.0.0 release
• 427b1da Merge pull request #634 from oasisprotocol/ml/wagmi-v2-example-multichain
• d21d46f wagmi-v2-integration: Use client-js network configuration
• a14ad62 client-js: Add Pontus-X network configuration
• 70855ec wagmi-v2: Update README
• 28d8570 wagmi-v2-example: Add anvil service in action
• 7c87fd5 wagmi-v2-example: Reset write contract in case contract is redeployed
• Additional commits viewable in compare view

Updates ethers from 6.15.0 to 6.17.0

Release notes

Sourced from ethers's releases.

ethers/v6.17.0 (2026-06-18 00:49)

• Add requestRate throttle to calls (b48bfe3).
• Added provider requestRate throttle support (b74b6d3).
• Disable AlchemyProvider which does not provide the necessary API capacity for tests (1523ca8).
• Map ResolverNotFound error to null for reverse lookup (d07cfb6).
• Use bigint for coinType instead of number values (4f6ec03).
• Updated AlchemyProvider endpoints for BNB (9bec2f9).
• Added basic ENSv2 tests and fixed issues with EVM cointypes (0e9a73d).
• Adding ENSv2 integrations from adraffy (a2d0af4).
• Update Blockscout deffault API key and links (5647ae3).
• Added transactionsRoot to Block (#5077, #5078; 5bd2ce9).
• Preserve 301/302 method and support 307/308 (#3106, #5115; 999af5f).
• Fix maxFeePerGas property for EtherscanProvider transactions (#5080; ca45d23).
• Added rich inspection for Network and Plugins (f2ffb86).
• Tweaking API for Universal Resolver to be completely backward compatible (9a5c4b5).
• Updated ENS Universal Resolver to latest API (0b3b12b).
• Added CCIP to ENS Universal Resolver reverse resolution (982eef2).
• Added reverse lookup for ENS UniversalResolver (9a9a11d).
• Initial forward resolution using ENS UniversalResolver (51df7b9).

ethers/v6.16.0 (2025-12-02 19:47)

• Added utility method to split EIP-7594 BLOb proofs into its cells (88dfe96).
• Update Alchemy URL endpoint for mainnet (#5052; 719b01d).
• Fail on unsupported Etherscan networks immediately to better support the default provider (94b333b).
• Added Filecoin network and Ankr endpoints (#5038; 986e827).
• Moved to better API for EIP-7594 PeerDAS (#5062; 452b422).
• Added initial EIP-7594 PeerDAS support (#5054, #5062; 6d64889).
• Support RegExp engines with string length limitations (#4967; f0dfbe1).
• Added Transaction and Signature support for non-canonical S values (#4223, #5013; 855d727).
• Allow zero-width big-endian data for toBeHex and allow widths fo toBeArray (#5025; 540f30c).

Changelog

Sourced from ethers's changelog.

ethers/v6.17.0 (2026-06-17 23:50)

• Add requestRate throttle to calls (b48bfe3).
• Added provider requestRate throttle support (b74b6d3).
• Disable AlchemyProvider which does not provide the necessary API capacity for tests (1523ca8).
• Map ResolverNotFound error to null for reverse lookup (d07cfb6).
• Use bigint for coinType instead of number values (4f6ec03).
• Updated AlchemyProvider endpoints for BNB (9bec2f9).
• Added basic ENSv2 tests and fixed issues with EVM cointypes (0e9a73d).
• Adding ENSv2 integrations from adraffy (a2d0af4).
• Update Blockscout deffault API key and links (5647ae3).
• Added transactionsRoot to Block (#5077, #5078; 5bd2ce9).
• Preserve 301/302 method and support 307/308 (#3106, #5115; 999af5f).
• Fix maxFeePerGas property for EtherscanProvider transactions (#5080; ca45d23).
• Added rich inspection for Network and Plugins (f2ffb86).
• Tweaking API for Universal Resolver to be completely backward compatible (9a5c4b5).
• Updated ENS Universal Resolver to latest API (0b3b12b).
• Added CCIP to ENS Universal Resolver reverse resolution (982eef2).
• Added reverse lookup for ENS UniversalResolver (9a9a11d).
• Initial forward resolution using ENS UniversalResolver (51df7b9).

ethers/v6.16.0 (2025-12-02 19:47)

• Added utility method to split EIP-7594 BLOb proofs into its cells (88dfe96).
• Update Alchemy URL endpoint for mainnet (#5052; 719b01d).
• Fail on unsupported Etherscan networks immediately to better support the default provider (94b333b).
• Added Filecoin network and Ankr endpoints (#5038; 986e827).
• Moved to better API for EIP-7594 PeerDAS (#5062; 452b422).
• Added initial EIP-7594 PeerDAS support (#5054, #5062; 6d64889).
• Support RegExp engines with string length limitations (#4967; f0dfbe1).
• Added Transaction and Signature support for non-canonical S values (#4223, #5013; 855d727).
• Allow zero-width big-endian data for toBeHex and allow widths fo toBeArray (#5025; 540f30c).

Commits

• 3ea4c22 admin: updated dist files
• 2d35b6a docs: fix property access order for Flatworm
• b48bfe3 Add requestRate throttle to calls.
• 39f5ce1 tests: add INFURA_APIKEY for docs and workflows
• 96bd29c tests: added provider throttling to test suites
• b74b6d3 Added provider requestRate throttle support.
• 1523ca8 Disable AlchemyProvider which does not provide the necessary API capacity for...
• d07cfb6 Map ResolverNotFound error to null for reverse lookup.
• c32c542 docs: fix typo in config for INFURA API key
• 7c6b840 admin: include INFURA_APIKEY in docs generation to resolve throttling
• Additional commits viewable in compare view

[alexcos20]

see #2137

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.