Tom Boucher 51b23c248a fix(#1274): bump ws to ^8.21.0 to clear advisory GHSA-96hv-2xvq-fx4p (#1275) ...

The direct production dependency ws was pinned to 8.20.1, in the vulnerable
range of GHSA-96hv-2xvq-fx4p (high — memory-exhaustion DoS). The freshly
disclosed advisory turned the #3588 `npm audit --omit=dev reports zero
advisories` CI gate red repo-wide (next + every open PR). Bump to the
patched ^8.21.0 (backward-compatible). npm audit --omit=dev now reports 0.

Closes #1274

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-15 14:07:52 -04:00

186 KiB

Raw Blame History

View Raw