chore(deps): bump ws from 8.18.0 to 8.21.3

[dependabot]

Bumps ws from 8.18.0 to 8.21.3.

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• Additional commits viewable in compare view

[github-actions]

❌ Not Automerged

The PR does not match any automerge rules.

Details: No configuration rule matched this update

Dependabot Information:

• Package name(s): ws
• Update type: minor
• Dependency type: production
• Previous version: 8.18.0
• New version: 8.21.3

Modified Files:

• package-lock.json
• package.json

[github-actions]

❌ Not Automerged

The PR does not match any automerge rules.

Details: No configuration rule matched this update

Dependabot Information:

• Package name(s): ws
• Update type: minor
• Dependency type: production
• Previous version: 8.18.0
• New version: 8.21.3

Modified Files:

• package-lock.json
• package.json

[github-actions]

❌ Not Automerged

The PR does not match any automerge rules.

Details: No configuration rule matched this update

Dependabot Information:

• Package name(s): ws
• Update type: minor
• Dependency type: production
• Previous version: 8.18.0
• New version: 8.21.3

Modified Files:

• package-lock.json
• package.json

[DutchmanNL]

Superseded by the consolidated dependency update in #867 (merged).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.