Bumps [ws](https://github.com/websockets/ws), [engine.io-client](https://github.com/socketio/socket.io), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together. Updates `ws` from 8.17.1 to 8.21.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.1</h2> <h1>Bug fixes</h1> <ul> <li>Empty fragments are now counted toward the limit (a2f4e7c0).</li> <li>The default values of the <code>maxBufferedChunks</code> and <code>maxFragments</code> options have been reduced (f197ac65).</li> </ul> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/ae1de54330cef77e487548890fabfeb9aae1d83d"><code>ae1de54</code></a> [dist] 8.21.1</li> <li><a href="https://github.com/websockets/ws/commit/8e9511b86b3fc6deebbd97dd9af7c9056deea8d1"><code>8e9511b</code></a> [ci] Trust Coveralls Homebrew tap</li> <li><a href="https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d"><code>f197ac6</code></a> [fix] Lower default values of <code>maxBufferedChunks</code> and <code>maxFragments</code></li> <li><a href="https://github.com/websockets/ws/commit/8df8265c2f63fd44af3193a98e23cf38888cd991"><code>8df8265</code></a> [ci] Update actions/checkout action to v7</li> <li><a href="https://github.com/websockets/ws/commit/a2f4e7c046c2112bbce6fef39a083dac77d6f0d2"><code>a2f4e7c</code></a> [fix] Count empty fragments toward the limit (<a href="https://redirect.github.com/websockets/ws/issues/2329">#2329</a>)</li> <li><a href="https://github.com/websockets/ws/commit/e79f912cb3f492ae04c28feb9459a209e186b0ad"><code>e79f912</code></a> [pkg] Approve install scripts for bufferutil and utf-8-validate</li> <li><a href="https://github.com/websockets/ws/commit/4ea355d6d3069394994f82ca1b6d38c32ba208fb"><code>4ea355d</code></a> [doc] Document 32-bit signed integer coercion for option values</li> <li><a href="https://github.com/websockets/ws/commit/2120f4c8c625a76316792680a231496e1b615252"><code>2120f4c</code></a> [example] Remove uuid dependency</li> <li><a href="https://github.com/websockets/ws/commit/4c534a6b8a5224a563af116e85c6ced7d4ca60cf"><code>4c534a6</code></a> [security] Add latest vulnerability to SECURITY.md</li> <li><a href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a> [dist] 8.21.0</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.17.1...8.21.1">compare view</a></li> </ul> </details> <br /> Updates `engine.io-client` from 6.6.3 to 6.6.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">engine.io-client's releases</a>.</em></p> <blockquote> <h2>engine.io-client@6.6.6</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h3>Bug Fixes</h3> <ul> <li>preserve transport literal suggestions (<a href="https://redirect.github.com/socketio/socket.io/pull/5469">#5469</a>) (<a href="https://github.com/socketio/socket.io/commit/d8f392eec724f9f6d78a9523f8ef7a383a807a6d">d8f392e</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.21.0"><code>ws@~8.21.0</code></a> (<a href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">diff</a>)</li> </ul> <h2>engine.io-client@6.6.5</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1"><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">diff</a>)</li> </ul> <h2>engine.io-client@6.6.4</h2> <p>This release contains a bump of:</p> <ul> <li><code>ws</code> from <code>~8.17.1</code> to <code>~8.18.3</code></li> <li><code>debug</code> from <code>~4.3.1</code> to <code>~4.4.1</code></li> </ul> <h3>Bug Fixes</h3> <ul> <li>properly handle port option (<a href="https://redirect.github.com/socketio/socket.io/issues/5241">#5241</a>) (<a href="https://github.com/socketio/socket.io/commit/1da9cddeab0bf5ce41890d156d73af8194cef656">1da9cdd</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.18.3"><code>ws@~8.18.3</code></a> (<a href="https://github.com/websockets/ws/compare/8.17.1...8.18.3">diff</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/22cc483786a5084b8c6d8595e46f7d99d1587fea"><code>22cc483</code></a> chore(release): engine.io-client@6.6.6</li> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da"><code>9dbec81</code></a> chore(release): engine.io@6.6.9</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf"><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1"><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604"><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508">#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49"><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9"><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70"><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0"><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li><a href="https://github.com/socketio/socket.io/commit/190572d2459681a757e23e6010939ac5e53fdfcf"><code>190572d</code></a> refactor(eio-client): remove XMLHttpRequest from the definition file</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/engine.io-client@6.6.3...engine.io-client@6.6.6">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for engine.io-client since your current version.</p> </details> <br /> Updates `engine.io` from 6.6.2 to 6.6.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">engine.io's releases</a>.</em></p> <blockquote> <h2>engine.io@6.6.9</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.21.0"><code>ws@~8.21.0</code></a> (<a href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">diff</a>)</li> </ul> <h2>engine.io-client@6.6.5</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1"><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">diff</a>)</li> </ul> <h2>engine.io@6.6.8</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Bug Fixes</h3> <ul> <li>clean up resources upon WebTransport handshake failure (<a href="https://github.com/socketio/socket.io/commit/f86b95fdba6dd260b3d2f57e69537aeb8de904bb">f86b95f</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1"><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">diff</a>)</li> </ul> <h2>engine.io@6.6.7</h2> <h3>Bug Fixes</h3> <ul> <li>close HTTP requests with invalid content type (<a href="https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671">fc11285</a>)</li> <li>handle invalid packets when upgrading to WebTransport (<a href="https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c">1fa1f46</a>)</li> <li>prevent WebTransport connections when a middleware is registered (<a href="https://github.com/socketio/socket.io/commit/d1f5aa93722a7f1ed729b96f771daf92a3dfdaf7">d1f5aa9</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.18.3"><code>ws@~8.18.3</code></a> (no change)</li> </ul> <h2>engine.io@6.6.6</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da"><code>9dbec81</code></a> chore(release): engine.io@6.6.9</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf"><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1"><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604"><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508">#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49"><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9"><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70"><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0"><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li><a href="https://github.com/socketio/socket.io/commit/190572d2459681a757e23e6010939ac5e53fdfcf"><code>190572d</code></a> refactor(eio-client): remove XMLHttpRequest from the definition file</li> <li><a href="https://github.com/socketio/socket.io/commit/fad463c54d04799e1592361b0fd8344a5fab960d"><code>fad463c</code></a> docs(examples): fix duplicate self messages (<a href="https://redirect.github.com/socketio/socket.io/issues/5341">#5341</a>)</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for engine.io since your current version.</p> </details> <br /> Updates `socket.io-adapter` from 2.5.2 to 2.5.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">socket.io-adapter's releases</a>.</em></p> <blockquote> <h2>socket.io-adapter@2.5.8</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h2>socket.io-adapter@2.5.7</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Bug Fixes</h3> <ul> <li>do not skip local broadcast when publishAndReturnOffset throws (<a href="https://redirect.github.com/socketio/socket.IO/issues/5457">#5457</a>) (<a href="https://github.com/socketio/socket.io/commit/f6301588ca65de270ecfe22da9023d7ec79ba23a">f630158</a>)</li> </ul> <h2>socket.io-adapter@2.5.6</h2> <p>This release contains a bump of:</p> <ul> <li><code>ws</code> from <code>~8.17.1</code> to <code>~8.18.3</code></li> <li><code>debug</code> from <code>~4.3.1</code> to <code>~4.4.1</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/socketio/socket.io/commits/socket.io-adapter@2.5.8">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for socket.io-adapter since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/plfa/plfa.github.io/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>