Bump ws, engine.io, socket.io-adapter and socket.io-client in /examples/server/javascript

[dependabot]

Bumps ws to 8.20.1 and updates ancestor dependencies ws, engine.io, socket.io-adapter and socket.io-client. These dependencies need to be updated together.

Updates ws from 8.17.1 to 8.20.1

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

• Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).

8.19.0

Features

• Added the closeTimeout option (#2308).

Bug fixes

• Handled a forthcoming breaking change in Node.js core (19984854).

... (truncated)

Commits

• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• 3ee5349 [api] Convert the isServer and maxPayload parameters to options
• 91707b4 [doc] Add missing space
• 8b55319 [pkg] Update eslint to version 10.0.1
• Additional commits viewable in compare view

Updates engine.io from 6.6.2 to 6.6.8

Release notes

Sourced from engine.io's releases.

engine.io@6.6.8

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Bug Fixes

• clean up resources upon WebTransport handshake failure (f86b95f)

Dependencies

• ws@~8.20.1 (diff)

engine.io@6.6.7

Bug Fixes

• close HTTP requests with invalid content type (fc11285)
• handle invalid packets when upgrading to WebTransport (1fa1f46)
• prevent WebTransport connections when a middleware is registered (d1f5aa9)

Dependencies

• ws@~8.18.3 (no change)

engine.io@6.6.6

Bug Fixes

• add @types/ws as dependency (#5458) (07cbe15)
• uws: emit initial_headers and headers events in uServer (#5460) (44ed73f)

Dependencies

• ws@~8.18.3 (no change)

engine.io-client@6.6.4

This release contains a bump of:

• ws from ~8.17.1 to ~8.18.3
• debug from ~4.3.1 to ~4.4.1

Bug Fixes

• properly handle port option (#5241) (1da9cdd)

... (truncated)

Commits

• ffe51e2 chore(release): engine.io@6.6.8
• f86b95f fix(eio): clean up resources upon WebTransport handshake failure
• 4276e59 refactor(eio): fix typo in the cookie option
• 5257ef9 chore(deps): upgrade to ws@8.20.1 (#5439)
• 439a8f6 chore(release): engine.io@6.6.7
• fc11285 fix(eio): close HTTP requests with invalid content type
• b059af6 refactor(eio): use plain IncomingMessage in the public API
• 4e85378 docs: fix various typos in test and documentation (#5481)
• d1f5aa9 fix(eio): prevent WebTransport connections when a middleware is registered
• b785377 docs: fix typos in the release notes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Updates socket.io-adapter from 2.5.5 to 2.5.7

Release notes

Sourced from socket.io-adapter's releases.

socket.io-adapter@2.5.7

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Bug Fixes

• do not skip local broadcast when publishAndReturnOffset throws (#5457) (f630158)

socket.io-adapter@2.5.6

This release contains a bump of:

• ws from ~8.17.1 to ~8.18.3
• debug from ~4.3.1 to ~4.4.1

Commits

• 4faff49 chore(release): socket.io-adapter@2.5.7
• 8413bce chore(release): engine.io-client@6.6.5
• c10fe07 refactor(eio-client): improve JSDoc documentation
• 9349b14 refactor(eio-client): remove unused import
• ffe51e2 chore(release): engine.io@6.6.8
• f86b95f fix(eio): clean up resources upon WebTransport handshake failure
• 4276e59 refactor(eio): fix typo in the cookie option
• 5257ef9 chore(deps): upgrade to ws@8.20.1 (#5439)
• 439a8f6 chore(release): engine.io@6.6.7
• fc11285 fix(eio): close HTTP requests with invalid content type
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io-adapter since your current version.

Updates socket.io-client from 4.7.2 to 4.8.3

Release notes

Sourced from socket.io-client's releases.

socket.io-client@4.8.3

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.18.3 (diff)

socket.io-client@4.8.2

Bug Fixes

• bundle: do not mangle the "_placeholder" attribute (bis) (cdae019)
• drain queue before emitting "connect" (#5259) (d19928e)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.17.1 (no change)

socket.io-client@4.8.1

Bug Fixes

• bundle: do not mangle the "_placeholder" attribute (ca9e994)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.17.1 (no change)

socket.io-client@4.8.0

Features

Custom transport implementations

The transports option now accepts an array of transport implementations:

import { io } from "socket.io-client";
import { XHR, WebSocket } from "engine.io-client";
const socket = io({
transports: [XHR, WebSocket]
});

Here is the list of provided implementations:

| Transport | Description |

... (truncated)

Commits

• e9e5bed chore(release): socket.io-client@4.8.3
• 9581f9b fix(sio): do not throw when calling io.close() on a stopped server
• 579d43f refactor: remove unused files
• ee9aac3 chore(release): socket.io-parser@4.2.5
• 968277c chore(release): socket.io-adapter@2.5.6
• 2bf16bd chore(release): engine.io-client@6.6.4
• ad61607 docs(eio): fix link in the release notes
• dd71792 chore(release): socket.io@4.8.2
• bb0b480 fix(sio): improve io.close() function (#5344)
• 161be91 test(sio): pin version of the client bundle in the tests
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io-client since your current version.