Bump ws from 8.18.3 to 8.21.1

[dependabot]

Bumps ws from 8.18.3 to 8.21.1.

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import{WebSocket,WebSocketServer}from'ws';constwss=newWebSocketServer({port: 0},function(){constdata=Buffer.alloc(1);constoptions={fin: false};const{ port }=wss.address();constws=newWebSocket(ws://localhost:${port});ws.on('open',function(){(functionsend(){ws.send(data,options,function(err){if(err)return;send();});})();});ws.on('error',console.error);ws.on('close',function(code,reason){console.log(clientclose-code: ${code}reason: ${reason.toString()});});});wss.on('connection',function(ws){ws.on('error',console.error);ws.on('close',function(code,reason){console.log(serverclose-code: ${code}reason: ${reason.toString()});});});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view