fix: bump ws dependency from ^7.5.10 to ^8.21.1 (CVE-2026-48779)

[rajat2911]

Summary

Bumps the ws direct dependency from ^7.5.10 to ^8.21.1 and aligns @types/ws in devDependencies from ^7.2.3 to ^8.18.1 to address CVE-2026-48779 — a remote memory exhaustion DoS vulnerability.

Closes #10816

Changes

Package	Before	After
ws	^7.5.10	^8.21.1
@types/ws	^7.2.3	^8.18.1

Vulnerability

• CVE: CVE-2026-48779
• Severity: High
• Description: A high volume of tiny fragments and data chunks can be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
• Fixed in: ws@8.21.0 / ws@8.21.1

See: https://github.com/websockets/ws/releases/tag/8.21.0

Why ^7.5.10 doesn't help

The current ^7.5.10 range is forever locked to 7.x. The vulnerability fix landed in 8.21.0, so a major version bump is required — semver resolution will never pull in 8.x from a ^7.x range.

Compatibility

The ws 8.x API is backward-compatible for the usage patterns in this codebase (WebSocket.Server, ws.send(), ws.on("connection", ...)). No code changes are required beyond the version bumps in package.json.

Impact for consumers

Without this change, downstream users are forced to apply workarounds like npm overrides or yarn resolutions to avoid shipping vulnerable code — an unnecessary burden that an upstream fix eliminates.

[gemini-code-assist]

Code Review

This pull request updates the ws dependency in package.json to a new major version (^8.21.1). The review feedback correctly points out that the corresponding TypeScript type definitions (@types/ws) in devDependencies should also be updated to ^8.x.x to prevent potential type mismatch or compilation errors.

[rajat2911]

Hello @inlined @shettyvarun268 @Berlioz Could you guys please review this PR ?