Security: ws dependency pinned to vulnerable ^7.5.10 — please bump to ^8.21.1 (CVE-2026-48779)

[rajat2911]

Summary

firebase-tools currently declares ws: "^7.5.10" as a direct dependency. This semver range resolves to the latest 7.x patch release, which is vulnerable to CVE-2026-48779 — a remote memory exhaustion DoS vulnerability fixed in ws@8.21.0.

Vulnerability details

• CVE: CVE-2026-48779
• Severity: High
• Fix: ws >= 8.21.0
• Description: A high volume of tiny fragments and data chunks can be sent by a peer using modest network traffic to crash a ws server or client due to OOM.
• Fixed in: ws@8.21.0 (released) and ws@8.21.1

See: https://github.com/websockets/ws/releases/tag/8.21.0

Current state

As of firebase-tools@15.24.0 (latest), package.json still declares:

"ws": "^7.5.10"

This range will never resolve to 8.x, so the vulnerability persists regardless of what ws version is available in the npm registry.

Request

Please bump the ws dependency to ^8.21.1 (or >=8.21.1).

Without this, consumers are forced to use npm overrides / yarn resolutions workarounds to force a safe version:

"resolutions": {
  "ws": ">=8.21.1"
}

This is a maintenance burden and easy to miss in downstream projects. An upstream fix in firebase-tools is the correct long-term solution.

[rajat2911]

Still not included in v15.25.1

PR #10854 was merged into main on 2026-07-27 but the subsequent releases v15.25.0 (2026-07-29) and v15.25.1 (2026-07-30) still ship ws@7.5.10 in the resolved dependency tree.

We are blocked on releasing a security fix in our own repo because of this. We added a temporary overrides workaround in our Dockerfile but have a revert PR waiting:
https://github.com/UKGEPIC/swp-web-client/pull/4396

Could you please ensure the fix from #10854 is included in the next tagged release? Given the CVE severity (High) a patch release with just this fix would be ideal.

Thanks

cc @inlined @shettyvarun268 @Berlioz @joehan