fix: Bump ws from 8.21.0 to 8.21.3

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

ws before 8.21.1 is vulnerable to memory exhaustion via incomplete fragmented messages: GHSA-73jw-fp74-p77x / CVE-2026-62389 (HIGH), reported in websockets/ws#2331. The fix for GHSA-96hv-2xvq-fx4p in ws 8.21.0 added the maxFragments and maxBufferedChunks limits, but their defaults were high enough that a peer could send a text frame with FIN=0 followed by many tiny continuation frames, never finish the message, and pin a lot of heap memory. ws 8.21.1 fixes this.

ws is a direct production dependency of the SDK. The Node.js build uses it as the WebSocket implementation for the LiveQuery client (src/WebSocketController.ts). The GitHub Advisory Database lists this advisory as unreviewed, with no structured affected version ranges, so Dependabot has raised neither an alert nor a PR for it.

Approach

Bump ws from 8.21.0 to 8.21.3, the latest release, with an exact pin as before. Only package.json and package-lock.json change: the root ws entry, and its version, resolved and integrity fields in the lock file. No other packages were re-resolved. ws 8.21.3 declares engines.node >=10.0.0, which is within this repository's engines.node range.

The SDK creates the socket with new WebSocket(serverURL) and no options, so the new ws defaults apply. They have no practical effect on LiveQuery traffic:

• Parse Server's LiveQuery server sends each message with a plain ws.send(), which produces a single unfragmented frame. That is far below the new maxFragments default of 16384.
• maxBufferedChunks counts socket reads buffered while a frame is incomplete. At the new default of 262144, a limit is only reached for payloads far above the 100 MiB maxPayload default.

As a local check, a ws 8.21.3 client with default options received a 20 MiB single-frame message without error. The LiveQuery client path is already covered end to end by integration/test/ParseLiveQueryTest.js, which runs the Node.js build against a real Parse Server LiveQuery server in CI on every Node.js version in the matrix. So no new tests were added.

Changes

• 8.21.1: Empty fragments are now counted toward the maxFragments limit (websockets/ws@a2f4e7c, fix: count empty continuation frames toward the maxFragments limit websockets/ws#2329). The default values of maxBufferedChunks (1048576 → 262144) and maxFragments (131072 → 16384) were lowered (websockets/ws@f197ac6, Default maxFragments still allows memory-exhaustion DoS (incomplete GHSA-96hv-2xvq-fx4p fix) websockets/ws#2331, [fix] Fixing Default maxFragments still allows memory exhaustion Dos websockets/ws#2332). This fixes GHSA-73jw-fp74-p77x / CVE-2026-62389.
• 8.21.2: Test-only fix for CITGM (websockets/ws@2eb3be0). No change to library code.
• 8.21.3: A ws server now correctly rejects permessage-deflate offers whose client_max_window_bits is smaller than its configured clientMaxWindowBits (websockets/ws@e97a20e). This is server-side only and does not affect the SDK, which uses ws only as a client.

Full diff: websockets/ws@8.21.0...8.21.3

Breaking Changes

None. The lower maxFragments and maxBufferedChunks defaults are the security fix itself. Normal LiveQuery server messages stay far below them.

Code Changes Required

None. The upgrade is a drop-in replacement.

Tasks

No tasks apply. Existing LiveQuery integration tests already cover the ws client path, and no documentation changes are needed.

Summary by CodeRabbit

• Chores
  • Updated the app’s underlying real-time communication support to a newer version. No specific user-facing changes are noted.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 31b88051-c8d4-40ab-aac8-081bf9eb527f

📥 Commits

Reviewing files that changed from the base of the PR and between 4f4a54d and 10761ec.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: Your plan provides up to 5 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The ws dependency changes from version 8.21.0 to 8.21.3 in package.json and package-lock.json. The lockfile also updates the resolved tarball URL and integrity hash.

Changes

ws dependency update

Layer / File(s)	Summary
Update ws dependency package.json, package-lock.json	The manifest and lockfile specify ws version 8.21.3. The lockfile entries also update the resolved tarball URL and integrity hash.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: semantic-release-bot

Merge Risk: ⚪ Minimal · up to 10761

The dependency update is ready to merge after normal checks; no actionable compatibility issue is established.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title starts with the allowed fix: prefix, uses a capitalized first word, and accurately describes the ws dependency upgrade.
Description check	✅ Passed	The description includes all required sections and clearly explains the security issue, dependency upgrade, testing rationale, and task status.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	PASS. The pull request changes only package.json and package-lock.json dependency metadata. It pins ws to 8.21.3 and updates the matching registry URL and integrity hash. No executable code, Web…
Engage In Review Feedback	✅ Passed	The supplied review result reports zero actionable findings in the current review. No review feedback required engagement, implementation, or discussion.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.98%. Comparing base (d10c78a) to head (10761ec).
⚠️ Report is 3 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha    #3119   +/-   ##
=======================================
  Coverage   99.98%   99.98%           
=======================================
  Files          64       64           
  Lines        6339     6339           
  Branches     1538     1526   -12     
=======================================
  Hits         6338     6338           
  Misses          1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 8.6.2-alpha.1

[parseplatformorg]

🎉 This change has been released in version 8.6.2