fix(#1274): bump ws to ^8.21.0 to clear advisory GHSA-96hv-2xvq-fx4p (#1275)

The direct production dependency ws was pinned to 8.20.1, in the vulnerable
range of GHSA-96hv-2xvq-fx4p (high — memory-exhaustion DoS). The freshly
disclosed advisory turned the #3588 `npm audit --omit=dev reports zero
advisories` CI gate red repo-wide (next + every open PR). Bump to the
patched ^8.21.0 (backward-compatible). npm audit --omit=dev now reports 0.

Closes #1274

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.2.84",
-        "ws": "8.20.1"
+        "ws": "^8.21.0"
       },
       "bin": {
         "gsd_run": "gsd-core/bin/gsd_run",
@@ -5207,9 +5207,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package.json

@@ -50,7 +50,7 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.84",
-    "ws": "8.20.1"
+    "ws": "^8.21.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",