fix: bump ws dependency from ^7.5.10 to ^8.21.1 (CVE-2026-48779)

[rajat2911]

Summary

Bumps the ws direct dependency from ^7.5.10 to ^8.21.1 and aligns @types/ws in devDependencies from ^7.2.3 to ^8.18.1 to address CVE-2026-48779 — a remote memory exhaustion DoS vulnerability.

Closes #10816

Changes

Package	Before	After
ws	^7.5.10	^8.21.1
@types/ws	^7.2.3	^8.18.1

Vulnerability

• CVE: CVE-2026-48779
• Severity: High
• Description: A high volume of tiny fragments and data chunks can be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
• Fixed in: ws@8.21.0 / ws@8.21.1

See: https://github.com/websockets/ws/releases/tag/8.21.0

Why ^7.5.10 doesn't help

The current ^7.5.10 range is forever locked to 7.x. The vulnerability fix landed in 8.21.0, so a major version bump is required — semver resolution will never pull in 8.x from a ^7.x range.

Compatibility

The ws 8.x API is backward-compatible for the usage patterns in this codebase (WebSocket.Server, ws.send(), ws.on("connection", ...)). No code changes are required beyond the version bumps in package.json.

Impact for consumers

Without this change, downstream users are forced to apply workarounds like npm overrides or yarn resolutions to avoid shipping vulnerable code — an unnecessary burden that an upstream fix eliminates.

[gemini-code-assist]

Code Review

This pull request updates the ws dependency in package.json to a new major version (^8.21.1). The review feedback correctly points out that the corresponding TypeScript type definitions (@types/ws) in devDependencies should also be updated to ^8.x.x to prevent potential type mismatch or compilation errors.

[rajat2911]

Hello @inlined @shettyvarun268 @Berlioz Could you guys please review this PR ?

[joehan]

CLosing in favor of #10853 (which includes your commit). Thank you for the contibution!

[rajat2911]

thanks @joehan when are we planning to have new verion for firebase tools

[rajat2911]

This PR was superseded by #10854 which got merged on 2026-07-27, however the fix has still not made it into a released version. Both v15.25.0 (2026-07-29) and v15.25.1 (2026-07-30) were released after the merge but still ship ws@7.5.10.

We are currently blocked on this — we have a temporary overrides workaround in our Dockerfile and a revert PR waiting to be merged once a fixed release is out:
https://github.com/UKGEPIC/swp-web-client/pull/4396

Could you please cut a new patch release that includes #10854?

cc @inlined @shettyvarun268 @Berlioz @joehan