chore(deps): bump ws, engine.io, socket.io-adapter and engine.io-client in /tests

[dependabot]

Bumps ws, engine.io, socket.io-adapter and engine.io-client. These dependencies needed to be updated together.
Updates ws from 8.20.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Updates engine.io from 6.6.6 to 6.6.9

Commits

• 9dbec81 chore(release): engine.io@6.6.9
• 3ad4e1f docs: improve example with PM2
• 0e5afee docs: add example with PM2
• eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
• c17890c docs: add documentation about WebTransport
• 20df6ae docs(examples): add client-side load balancing example
• 16d1923 ci(publish): enable staged publishing
• ad48a9b docs(examples): add example with HTTP/2
• 190572d refactor(eio-client): remove XMLHttpRequest from the definition file
• fad463c docs(examples): fix duplicate self messages (#5341)
• Additional commits viewable in compare view

Updates socket.io-adapter from 2.5.6 to 2.5.8

Release notes

Sourced from socket.io-adapter's releases.

socket.io-adapter@2.5.8

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

socket.io-adapter@2.5.7

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Bug Fixes

• do not skip local broadcast when publishAndReturnOffset throws (#5457) (f630158)

Commits

• ac83bfa chore(release): socket.io-adapter@2.5.8
• 22cc483 chore(release): engine.io-client@6.6.6
• 9dbec81 chore(release): engine.io@6.6.9
• 3ad4e1f docs: improve example with PM2
• 0e5afee docs: add example with PM2
• eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
• c17890c docs: add documentation about WebTransport
• 20df6ae docs(examples): add client-side load balancing example
• 16d1923 ci(publish): enable staged publishing
• ad48a9b docs(examples): add example with HTTP/2
• Additional commits viewable in compare view

Updates engine.io-client from 6.6.4 to 6.6.6

Release notes

Sourced from engine.io-client's releases.

engine.io-client@6.6.6

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

Bug Fixes

• preserve transport literal suggestions (#5469) (d8f392e)

Dependencies

• ws@~8.21.0 (diff)

engine.io-client@6.6.5

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Dependencies

• ws@~8.20.1 (diff)

Commits

• 22cc483 chore(release): engine.io-client@6.6.6
• 9dbec81 chore(release): engine.io@6.6.9
• 3ad4e1f docs: improve example with PM2
• 0e5afee docs: add example with PM2
• eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
• c17890c docs: add documentation about WebTransport
• 20df6ae docs(examples): add client-side load balancing example
• 16d1923 ci(publish): enable staged publishing
• ad48a9b docs(examples): add example with HTTP/2
• 190572d refactor(eio-client): remove XMLHttpRequest from the definition file
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only dev-dependency updates in the tests package; no application source changes, though WebSocket behavior limits change slightly in patched ws.

Overview
Updates tests/package-lock.json so the eval test package pulls in patched WebSocket and Socket.IO transitive dependencies.

ws moves from 8.20.0 to 8.21.1, including fixes for fragment/chunk handling that address a remote memory-exhaustion DoS (CVE-2026-48779). engine.io (6.6.6 → 6.6.9), engine.io-client (6.6.4 → 6.6.6), and socket.io-adapter (2.5.6 → 2.5.8) are bumped together so they depend on ws ~8.21.0 instead of nested 8.18.3 copies. The lockfile also drops duplicate nested ws entries and prunes optional chokidar-related packages from the tree.

^{Reviewed by Cursor Bugbot for commit 682c264. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	0/100 (0/4)	-100
agentcontrol/configs-update	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/configs-variations	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/tools	75/100 (3/4)	0/100 (0/4)	-75
feature-flags/flag-and-release-change	-	0/100 (0/4)	new
feature-flags/flag-release	-	0/100 (0/5)	new
feature-flags/launchdarkly-flag-command	-	0/100 (0/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	0/100 (0/4)	-100
feature-flags/launchdarkly-flag-drift	-	0/100 (0/4)	new
feature-flags/should-flag-change	-	0/100 (0/10)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.