fix: bump ws dependency to ^8.21.1 (CVE-2026-48779)

package.json

@@ -173,7 +173,7 @@
     "undici": "^6.19.0",
     "winston": "^3.0.0",
     "winston-transport": "^4.4.0",
-    "ws": "^7.5.10",
+    "ws": "^8.21.1",
     "yaml": "^2.8.3",
     "zod": "^4.0.0"
   },
@@ -225,7 +225,7 @@
     "@types/triple-beam": "^1.3.0",
     "@types/universal-analytics": "^0.4.5",
     "@types/update-notifier": "^5.1.0",
-    "@types/ws": "^7.2.3",
+    "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^5.9.0",
     "@typescript-eslint/parser": "^5.9.0",
     "astro": "^2.2.3",

src/emulator/loggingEmulator.spec.ts

@@ -0,0 +1,53 @@
+import { expect } from "chai";
+import { LogEntry } from "winston";
+import * as WebSocket from "ws";
+import { LoggingEmulator } from "./loggingEmulator";
+import { logger } from "../logger";
+
+describe("LoggingEmulator", () => {
+  let emulator: LoggingEmulator;
+  let client: WebSocket | undefined;
+  const port = 4501;
+
+  afterEach(async () => {
+    if (client) {
+      client.close();
+      client = undefined;
+    }
+    if (emulator) {
+      await emulator.stop();
+    }
+  });
+
+  it("should start and broadcast log messages", async () => {
+    emulator = new LoggingEmulator({ port, host: "127.0.0.1" });
+    await emulator.start();
+
+    client = new WebSocket(`ws://127.0.0.1:${port}`);
+
+    const messagePromise = new Promise<LogEntry>((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        reject(new Error("Timeout waiting for message"));
+      }, 5000);
+
+      client!.on("message", (data) => {
+        clearTimeout(timeout);
+        try {
+          resolve(JSON.parse(data.toString()) as LogEntry);
+        } catch (e) {
+          reject(e);
+        }
+      });
+    });
+
+    await new Promise<void>((resolve, reject) => {
+      client!.on("open", () => resolve());
+      client!.on("error", (err) => reject(err));
+    });
+
+    logger.info("Hello world from unit test!");
+
+    const receivedMessage = await messagePromise;
+    expect(receivedMessage.message).to.contain("Hello world from unit test!");
+  });
+});