chore(deps): bump ws from 8.20.1 to 8.21.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: ws.

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• See full diff in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 008a40f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🟡 assemblyai plugin uses hardcoded ws version instead of catalog: like all other plugins

Every other plugin in the repository (anam, baseten, cartesia, deepgram, elevenlabs, fishaudio, inworld, liveavatar, minimax, neuphonic, openai, resemble, rime, sarvam, silero, soniox, xai) specifies "ws": "catalog:" which resolves to ^8.18.0 from pnpm-workspace.yaml. The assemblyai plugin instead uses a hardcoded version (^8.21.0), which means it won't benefit from centralized version management. If the catalog ws version is updated in the future, assemblyai will be missed. The PR should have switched this to "ws": "catalog:" and, if needed, bumped the catalog version in pnpm-workspace.yaml to ^8.21.0.

Prompt for agents

The assemblyai plugin hardcodes its ws dependency version as "^8.21.0" rather than using "catalog:" like all other plugins. To fix this consistently:

1. In plugins/assemblyai/package.json, change `"ws": "^8.21.0"` to `"ws": "catalog:"`
2. In pnpm-workspace.yaml, update the catalog entry for ws from `^8.18.0` to `^8.21.0` so all plugins get the security fix

This ensures centralized version management and that the security bump applies consistently across all plugins.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🚩 Security bump scope may be incomplete across the monorepo

The pnpm-workspace.yaml catalog defines ws: ^8.18.0, which all plugins except assemblyai reference via catalog:. Since ^8.18.0 already satisfies >=8.21.0 in semver resolution, the actual installed version in the lockfile may already be 8.21.x for all plugins depending on when pnpm install was last run. However, the catalog minimum floor remains at ^8.18.0, meaning a fresh install could theoretically resolve to 8.18.0–8.20.x for the other plugins if those versions are still available. If this bump is motivated by a security fix in ws 8.21.0, the catalog version in pnpm-workspace.yaml:24 should also be bumped to ensure all plugins enforce the minimum safe version.

---

Was this helpful? React with 👍 or 👎 to provide feedback.