fix(deps): bump ws from 8.20.0 to 8.20.1

[dependabot]

Bumps ws from 8.20.0 to 8.20.1.

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import{deepStrictEqual}from'node:assert';import{WebSocket,WebSocketServer}from'ws';constwss=newWebSocketServer({port: 0,skipUTF8Validation: true},function(){const{ port }=wss.address();constws=newWebSocket(ws://localhost:${port},{skipUTF8Validation: true});ws.on('close',function(code,reason){deepStrictEqual(reason,Buffer.alloc(80));});});wss.on('connection',function(ws){ws.close(1000,newFloat32Array(20));});

The issue was privately reported by Nikita Skovoroda.

Commits

• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli-web-cli	Ready	Preview, Comment	Jun 12, 2026 11:42am

[ci-lockfile-regen]

Dependabot Fix Assessment

Package: ws8.20.0 → 8.20.1 (patch)
Scope: runtime dependency (root package.jsondependencies)
Workspace: root

What changed upstream

• Security patch: fixed an uninitialized memory disclosure in websocket.close() — when a TypedArray was incorrectly passed as the reason argument instead of a string or Buffer, uninitialized memory could leak to the remote peer
• No API changes, no behavior changes, no breaking changes
• See: https://github.com/websockets/ws/releases

Migration concerns checked

• Peer dependencies: ✅ OK
• Type changes: ✅ OK (no API changes)
• Config files: ✅ OK
• Module format: ✅ OK
• React compatibility: ✅ OK
• Monorepo impact: ✅ OK — ws is not listed in packages/react-web-cli or examples/web-cli dependencies; it's a root dep and its transitive dependents (Ably SDK, jsdom) are unaffected by a patch bump

Note: ws is not directly imported anywhere in our source code. It's a transitive dependency used by the Ably SDK and jsdom (via vitest). The resolved lockfile version is ws@8.21.0 (pnpm resolves ^8.20.1 to the latest available 8.x).

What broke

• Web CLI E2E test "bottom drawer adapts to different screen sizes": transient infrastructure failure — NOT caused by the ws bump

  Root cause: the test ran after two other parallel tests had already consumed the terminal server's anonymous session limit. The browser console shows the explicit server message:

  Session ended: anonymous session limit reached (50/50)

  The test then hit progressive rate-limiting (Too many connection attempts. Please try again in Xs) and timed out after 120 seconds in the disconnected state.

  Evidence this is unrelated to the ws change:

  1. The error is purely server-side — the terminal server (wss://web-cli-terminal.ably-dev.com) enforces a cap of 50 anonymous sessions
  2. Other tests in the same parallel run that also use WebSocket connections passed fine
  3. The ws patch only changes websocket.close() error handling; it cannot affect connection limits
  4. ws is not imported directly in our code

What was fixed

No code changes required. This is a safe, clean dependency bump.

Verification

• Build: ✅ (no source changes)
• Lint: ✅ (no source changes)
• Unit tests: ✅ (no source changes)
• Web CLI E2E tests: ❌ flaky (server rate limit hit during parallel run — unrelated to this PR)

Notes for reviewer

The E2E test failure is a pre-existing flakiness issue with the parallel test suite exhausting the terminal server's anonymous session quota. It is not introduced by this PR and should not block merging. This PR is safe to merge.

[dependabot]

Superseded by #423.