chore(deps): bump ws and socket.io-client in /frontend by dependabot[bot] · Pull Request #3875 · linuxfoundation/crowd.dev

dependabot · 2026-02-24T16:58:24Z

Bumps ws to 8.19.0 and updates ancestor dependency socket.io-client. These dependencies need to be updated together.

Updates ws from 8.11.0 to 8.19.0

Release notes

8.19.0

Features

Added the closeTimeout option (#2308).

Bug fixes

Handled a forthcoming breaking change in Node.js core (19984854).

8.18.3

Bug fixes

Fixed a spec violation where the Sec-WebSocket-Version header was not added to the HTTP response if the client requested version was either invalid or unacceptable (#2291).

8.18.2

Bug fixes

Fixed an issue that, during message decompression when the maximum size was exceeded, led to the emission of an inaccurate error and closure of the connection with an improper close code (#2285).

8.18.1

Bug fixes

The length of the UNIX domain socket paths in the tests has been shortened to make them work when run via CITGM (021f7b8b).

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
</tr></table>

... (truncated)

Commits

61349ec [dist] 8.19.0
3f9ffc6 [feature] Introduce the closeTimeout option (#2308)
1998485 [fix] Ensure all remaining data is read as a single chunk
726c373 [doc] Sort options alphabetically
b151f1e [ci] Update actions/checkout action to v6
dabdd5b [ci] Update actions/setup-node action to v6
86eac5b [ci] Test on node 25
1891e14 [ci] Update actions/setup-node action to v5
aa28c77 [ci] Update actions/checkout action to v5
dabbdec [dist] 8.18.3
Additional commits viewable in compare view

Updates socket.io-client from 4.6.1 to 4.8.3

Release notes

Sourced from socket.io-client's releases.

socket.io-client@4.8.2

Bug Fixes

bundle: do not mangle the "_placeholder" attribute (bis) (cdae019)

drain queue before emitting "connect" (#5259) (d19928e)

Dependencies

engine.io-client@~6.6.1 (no change)

ws@~8.17.1 (no change)

socket.io-client@4.8.1

Bug Fixes

bundle: do not mangle the "_placeholder" attribute (ca9e994)

Dependencies

engine.io-client@~6.6.1 (no change)

ws@~8.17.1 (no change)

socket.io-client@4.8.0

Features

Custom transport implementations

The transports option now accepts an array of transport implementations:
import { io } from "socket.io-client";
import { XHR, WebSocket } from "engine.io-client";
const socket = io({
transports: [XHR, WebSocket]
});
Here is the list of provided implementations:

Transport Description

Fetch HTTP long-polling based on the built-in fetch() method.

NodeXHR HTTP long-polling based on the XMLHttpRequest object provided by the xmlhttprequest-ssl package.

XHR HTTP long-polling based on the built-in XMLHttpRequest object.

NodeWebSocket WebSocket transport based on the WebSocket object provided by the ws package.

WebSocket WebSocket transport based on the built-in WebSocket object.

WebTransport WebTransport transport based on the built-in WebTransport object.

... (truncated)

Commits

e9e5bed chore(release): socket.io-client@4.8.3
9581f9b fix(sio): do not throw when calling io.close() on a stopped server
579d43f refactor: remove unused files
ee9aac3 chore(release): socket.io-parser@4.2.5
968277c chore(release): socket.io-adapter@2.5.6
2bf16bd chore(release): engine.io-client@6.6.4
ad61607 docs(eio): fix link in the release notes
dd71792 chore(release): socket.io@4.8.2
bb0b480 fix(sio): improve io.close() function (#5344)
161be91 test(sio): pin version of the client bundle in the tests
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for socket.io-client since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Low Risk
Dependency-only bump in the frontend websocket client stack; primary risk is regressions in realtime connection/transport behavior rather than application logic changes.

Overview
Updates the frontend dependency socket.io-client from 4.6.1 to 4.8.3 in package.json and refreshes package-lock.json accordingly.

The lockfile update pulls in newer transitive versions including engine.io-client (6.4.0 → 6.6.4), ws (8.11.0 → 8.18.3), engine.io-parser (5.0.6 → 5.2.3), and xmlhttprequest-ssl (2.0.0 → 2.1.2), plus updated nested debug/ms entries.

^{Written by Cursor Bugbot for commit 76888a4. This will update automatically on new commits. Configure here.}

Bumps [ws](https://github.com/websockets/ws) to 8.19.0 and updates ancestor dependency [socket.io-client](https://github.com/socketio/socket.io). These dependencies need to be updated together. Updates `ws` from 8.11.0 to 8.19.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.11.0...8.19.0) Updates `socket.io-client` from 4.6.1 to 4.8.3 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/4.6.1...socket.io-client@4.8.3) --- updated-dependencies: - dependency-name: ws dependency-version: 8.19.0 dependency-type: indirect - dependency-name: socket.io-client dependency-version: 4.8.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-02-24T16:58:37Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-02-24T16:58:43Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-02-24T16:58:51Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-02-24T17:01:44Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

…rn/frontend/multi-0babb84d3e

github-actions · 2026-02-24T17:03:07Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-02-24T17:03:13Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

cursor · 2026-02-24T17:03:18Z

frontend/package-lock.json

      "peerDependencies": {
        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
+        "utf-8-validate": ">=5.0.2"


Broadened utf-8-validate peer dependency range

Low Severity

The ws peer dependency constraint for utf-8-validate changes from ^5.0.2 to >=5.0.2, which permits future major versions. If a newer major utf-8-validate is installed in the dependency graph, ws may accept an incompatible native module at runtime.

github-actions · 2026-02-24T17:03:53Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 24, 2026

joanagmaia added 2 commits February 24, 2026 17:02

Merge remote-tracking branch 'origin/main' into dependabot/npm_and_ya…

cf6956a

…rn/frontend/multi-0babb84d3e

fix: package-lock.json

76888a4

cursor bot reviewed Feb 24, 2026

View reviewed changes

joanagmaia merged commit 1442bd1 into main Feb 24, 2026
17 checks passed

joanagmaia deleted the dependabot/npm_and_yarn/frontend/multi-0babb84d3e branch February 24, 2026 17:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump ws and socket.io-client in /frontend#3875

chore(deps): bump ws and socket.io-client in /frontend#3875
joanagmaia merged 3 commits intomainfrom
dependabot/npm_and_yarn/frontend/multi-0babb84d3e

dependabot bot commented on behalf of github Feb 24, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Transport	Description
`Fetch`	HTTP long-polling based on the built-in `fetch()` method.
`NodeXHR`	HTTP long-polling based on the `XMLHttpRequest` object provided by the `xmlhttprequest-ssl` package.
`XHR`	HTTP long-polling based on the built-in `XMLHttpRequest` object.
`NodeWebSocket`	WebSocket transport based on the `WebSocket` object provided by the `ws` package.
`WebSocket`	WebSocket transport based on the built-in `WebSocket` object.
`WebTransport`	WebTransport transport based on the built-in `WebTransport` object.

Conversation

dependabot bot commented on behalf of github Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.19.0

Features

Bug fixes

8.18.3

Bug fixes

8.18.2

Bug fixes

8.18.1

Bug fixes

8.18.0

Features

8.17.1

Bug fixes

socket.io-client@4.8.2

Bug Fixes

Dependencies

socket.io-client@4.8.1

Bug Fixes

Dependencies

socket.io-client@4.8.0

Features

Custom transport implementations

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

Broadened utf-8-validate peer dependency range

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Feb 24, 2026 •

edited

Loading

Broadened `utf-8-validate` peer dependency range