build(deps): bump ws from 7.5.9 to 8.20.1

[dependabot]

Bumps ws from 7.5.9 to 8.20.1.

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import{deepStrictEqual}from'node:assert';import{WebSocket,WebSocketServer}from'ws';constwss=newWebSocketServer({port: 0,skipUTF8Validation: true},function(){const{ port }=wss.address();constws=newWebSocket(ws://localhost:${port},{skipUTF8Validation: true});ws.on('close',function(code,reason){deepStrictEqual(reason,Buffer.alloc(80));});});wss.on('connection',function(ws){ws.close(1000,newFloat32Array(20));});

The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

• Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).

8.19.0

Features

• Added the closeTimeout option (#2308).

Bug fixes

• Handled a forthcoming breaking change in Node.js core (19984854).

... (truncated)

Commits

• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• 3ee5349 [api] Convert the isServer and maxPayload parameters to options
• 91707b4 [doc] Add missing space
• 8b55319 [pkg] Update eslint to version 10.0.1
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
scriptkit	Error		May 21, 2026 6:33am

[dependabot]

Superseded by #20.