chore(deps): bump ws from 8.20.0 to 8.21.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: ws.

Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• See full diff in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8773814

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Devin Review found 2 new potential issues.

[devin-ai-integration]

🔴 Lockfile not updated after dependency version bump, breaking CI installs

The dependency version specifier is bumped ("ws": "^8.21.0" at plugins/assemblyai/package.json:47) without updating the lockfile, so CI builds using frozen lockfile will fail because the resolved version (8.20.0) doesn't satisfy the new requirement.

Impact: CI pipelines and fresh installs will fail until the lockfile is regenerated.

Lockfile still references old specifier and incompatible resolved version

The pnpm-lock.yaml still contains:

plugins/assemblyai:
  dependencies:
    ws:
      specifier: ^8.16.0
      version: 8.20.0

The new package.json requires ^8.21.0, but the lockfile resolves to 8.20.0 which does NOT satisfy >=8.21.0 <9.0.0. Running pnpm install --frozen-lockfile (standard in CI) will error out. The fix is to run pnpm install to regenerate the lockfile with a ws version >= 8.21.0.

Prompt for agents

The pnpm-lock.yaml file needs to be regenerated after changing the ws version specifier from ^8.16.0 to ^8.21.0. Run `pnpm install` at the repository root to update the lockfile so that the resolved ws version satisfies the new ^8.21.0 requirement. The current lockfile resolves ws to 8.20.0 for the assemblyai plugin, which does not satisfy ^8.21.0.

---

Was this helpful? React with 👍 or 👎 to provide feedback.