chore(deps): bump ws from 8.20.1 to 8.21.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: ws.

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 42df6bd

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🟡 assemblyai plugin uses hardcoded ws version instead of catalog: like all other plugins

Every other plugin in the repository (anam, baseten, cartesia, deepgram, elevenlabs, fishaudio, inworld, liveavatar, minimax, neuphonic, openai, resemble, rime, sarvam, silero, soniox, xai) specifies "ws": "catalog:" which resolves to ^8.18.0 from pnpm-workspace.yaml. The assemblyai plugin instead uses a hardcoded version (^8.21.0), which means it won't benefit from centralized version management. If the catalog ws version is updated in the future, assemblyai will be missed. The PR should have switched this to "ws": "catalog:" and, if needed, bumped the catalog version in pnpm-workspace.yaml to ^8.21.0.

Prompt for agents

The assemblyai plugin hardcodes its ws dependency version as "^8.21.0" rather than using "catalog:" like all other plugins. To fix this consistently:

1. In plugins/assemblyai/package.json, change `"ws": "^8.21.0"` to `"ws": "catalog:"`
2. In pnpm-workspace.yaml, update the catalog entry for ws from `^8.18.0` to `^8.21.0` so all plugins get the security fix

This ensures centralized version management and that the security bump applies consistently across all plugins.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🚩 Security bump scope may be incomplete across the monorepo

The pnpm-workspace.yaml catalog defines ws: ^8.18.0, which all plugins except assemblyai reference via catalog:. Since ^8.18.0 already satisfies >=8.21.0 in semver resolution, the actual installed version in the lockfile may already be 8.21.x for all plugins depending on when pnpm install was last run. However, the catalog minimum floor remains at ^8.18.0, meaning a fresh install could theoretically resolve to 8.18.0–8.20.x for the other plugins if those versions are still available. If this bump is motivated by a security fix in ws 8.21.0, the catalog version in pnpm-workspace.yaml:24 should also be bumped to ensure all plugins enforce the minimum safe version.

---

Was this helpful? React with 👍 or 👎 to provide feedback.