Bump ws and netlify-cli

[dependabot]

Bumps ws to 8.21.0 and updates ancestor dependency netlify-cli. These dependencies need to be updated together.

Updates ws from 8.18.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• Additional commits viewable in compare view

Updates netlify-cli from 18.1.0 to 26.0.2

Release notes

Sourced from netlify-cli's releases.

v26.0.2

26.0.2 (2026-05-15)

Bug Fixes

• deps: unpin all dependencies (#8171) (47da71e)
• deps: update dependency @​netlify/blobs to ^10.7.5 (#8245) (54a2334)
• deps: update dependency @​netlify/dev to ^4.18.3 (#8246) (7141b22)
• deps: update dependency @​netlify/dev to ^4.18.4 (#8253) (0a70cf4)
• deps: update dependency @​netlify/functions to ^5.2.1 (#8254) (5d11c29)
• deps: update dependency uuid to v13.0.1 [security] (#8193) (b267a5e)
• deps: update netlify packages (#8247) (0875c46)
• deps: update netlify packages (#8251) (6194536)

v26.0.1

26.0.1 (2026-05-04)

Bug Fixes

• adjust import path to account for function specific directory (#8221) (e439393)
• deps: update dependency @​fastify/static to v9.1.1 [security] (#8165) (c3ffebf)
• don't use inquirer for non-interactive variant of "database migrations new" command (#8232) (41fc777)
• filter out more user error messages (#8230) (c94f4b7)

v26.0.0

26.0.0 (2026-04-28)

⚠ BREAKING CHANGES

• add support for new Netlify Database primitive (#8212)

Features

• add support for new Netlify Database primitive (#8212) (a153489)

Bug Fixes

• set NETLIFY_DB_DRIVER when running netlify dev (#8219) (3ececcd)

v25.6.2

25.6.2 (2026-04-28)

Bug Fixes

• Dev server fixes (#8211) (3deb552)

... (truncated)

Changelog

Sourced from netlify-cli's changelog.

26.0.2 (2026-05-15)

Bug Fixes

• deps: unpin all dependencies (#8171) (47da71e)
• deps: update dependency @​netlify/blobs to ^10.7.5 (#8245) (54a2334)
• deps: update dependency @​netlify/dev to ^4.18.3 (#8246) (7141b22)
• deps: update dependency @​netlify/dev to ^4.18.4 (#8253) (0a70cf4)
• deps: update dependency @​netlify/functions to ^5.2.1 (#8254) (5d11c29)
• deps: update dependency uuid to v13.0.1 [security] (#8193) (b267a5e)
• deps: update netlify packages (#8247) (0875c46)
• deps: update netlify packages (#8251) (6194536)

26.0.1 (2026-05-04)

Bug Fixes

• adjust import path to account for function specific directory (#8221) (e439393)
• deps: update dependency @​fastify/static to v9.1.1 [security] (#8165) (c3ffebf)
• don't use inquirer for non-interactive variant of "database migrations new" command (#8232) (41fc777)
• filter out more user error messages (#8230) (c94f4b7)

26.0.0 (2026-04-28)

⚠ BREAKING CHANGES

• add support for new Netlify Database primitive (#8212)

Features

• add support for new Netlify Database primitive (#8212) (a153489)

Bug Fixes

• set NETLIFY_DB_DRIVER when running netlify dev (#8219) (3ececcd)

25.6.2 (2026-04-28)

Bug Fixes

• Dev server fixes (#8211) (3deb552)
• stagger starter migrations (#8216) (0daf8ea)

25.6.1 (2026-04-27)

... (truncated)

Commits

• a2b2724 chore(main): release 26.0.2 (#8235)
• dcdf76d ci: use pnpm/action-setup on Windows for e2e tests (#8256)
• 0a70cf4 fix(deps): update dependency @​netlify/dev to ^4.18.4 (#8253)
• 5d11c29 fix(deps): update dependency @​netlify/functions to ^5.2.1 (#8254)
• 6194536 fix(deps): update netlify packages (#8251)
• 54a2334 fix(deps): update dependency @​netlify/blobs to ^10.7.5 (#8245)
• 0875c46 fix(deps): update netlify packages (#8247)
• 7141b22 fix(deps): update dependency @​netlify/dev to ^4.18.3 (#8246)
• 47da71e fix(deps): unpin all dependencies (#8171)
• 07fa4d1 build(deps): bump postcss from 8.5.3 to 8.5.14 in /site (#8214)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[netlify]

❌ Deploy Preview for devopsdays-web failed. Why did it fail? →

Name	Link
🔨 Latest commit	5dcdc6c
🔍 Latest deploy log	https://app.netlify.com/projects/devopsdays-web/deploys/6a145449c61ac20007670845

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.