Bump ws and socket.io

[dependabot]

Bumps ws and socket.io. These dependencies needed to be updated together.
Updates ws from 8.11.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Updates socket.io from 4.6.1 to 4.8.3

Release notes

Sourced from socket.io's releases.

socket.io@4.8.3

Bug Fixes

• do not throw when calling io.close() on a stopped server (9581f9b)

Dependencies

• engine.io@~6.6.0 (no change)
• ws@~8.18.3 (no change)

socket.io-client@4.8.3

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.18.3 (diff)

socket.io@4.8.2

The url.parse() function is now deprecated and has been replaced by new URL() (see 8af7019).

Bug Fixes

• call adapter.init() when creating each namespace (f3e1f5e)
• improve io.close() function (#5344) (bb0b480)

Dependencies

• engine.io@~6.6.0 (no change)
• ws@~8.18.3 (diff)

socket.io-client@4.8.2

Bug Fixes

• bundle: do not mangle the "_placeholder" attribute (bis) (cdae019)
• drain queue before emitting "connect" (#5259) (d19928e)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.17.1 (no change)

socket.io@4.8.1

Due to a change in the bundler configuration, the production bundle (socket.io.min.js) did not support sending and receiving binary data in version 4.8.0. This is now fixed.

Dependencies

... (truncated)

Commits

• 9978574 chore(release): socket.io@4.8.3
• e9e5bed chore(release): socket.io-client@4.8.3
• 9581f9b fix(sio): do not throw when calling io.close() on a stopped server
• 579d43f refactor: remove unused files
• ee9aac3 chore(release): socket.io-parser@4.2.5
• 968277c chore(release): socket.io-adapter@2.5.6
• 2bf16bd chore(release): engine.io-client@6.6.4
• ad61607 docs(eio): fix link in the release notes
• dd71792 chore(release): socket.io@4.8.2
• bb0b480 fix(sio): improve io.close() function (#5344)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io since your current version.