build(deps): bump ws, engine.io, socket.io-adapter, @nestjs/graphql, @nestjs/platform-ws and engine.io-client

[dependabot]

Bumps ws to 8.21.0 and updates ancestor dependencies ws, engine.io, socket.io-adapter, @nestjs/graphql, @nestjs/platform-ws and engine.io-client. These dependencies need to be updated together.

Updates ws from 8.18.3 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• Additional commits viewable in compare view

Updates engine.io from 6.6.6 to 6.6.8

Release notes

Sourced from engine.io's releases.

engine.io@6.6.8

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Bug Fixes

• clean up resources upon WebTransport handshake failure (f86b95f)

Dependencies

• ws@~8.20.1 (diff)

engine.io@6.6.7

Bug Fixes

• close HTTP requests with invalid content type (fc11285)
• handle invalid packets when upgrading to WebTransport (1fa1f46)
• prevent WebTransport connections when a middleware is registered (d1f5aa9)

Dependencies

• ws@~8.18.3 (no change)

Commits

• ffe51e2 chore(release): engine.io@6.6.8
• f86b95f fix(eio): clean up resources upon WebTransport handshake failure
• 4276e59 refactor(eio): fix typo in the cookie option
• 5257ef9 chore(deps): upgrade to ws@8.20.1 (#5439)
• 439a8f6 chore(release): engine.io@6.6.7
• fc11285 fix(eio): close HTTP requests with invalid content type
• b059af6 refactor(eio): use plain IncomingMessage in the public API
• 4e85378 docs: fix various typos in test and documentation (#5481)
• d1f5aa9 fix(eio): prevent WebTransport connections when a middleware is registered
• b785377 docs: fix typos in the release notes
• Additional commits viewable in compare view

Updates socket.io-adapter from 2.5.6 to 2.5.7

Release notes

Sourced from socket.io-adapter's releases.

socket.io-adapter@2.5.7

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Bug Fixes

• do not skip local broadcast when publishAndReturnOffset throws (#5457) (f630158)

Commits

• 4faff49 chore(release): socket.io-adapter@2.5.7
• 8413bce chore(release): engine.io-client@6.6.5
• c10fe07 refactor(eio-client): improve JSDoc documentation
• 9349b14 refactor(eio-client): remove unused import
• ffe51e2 chore(release): engine.io@6.6.8
• f86b95f fix(eio): clean up resources upon WebTransport handshake failure
• 4276e59 refactor(eio): fix typo in the cookie option
• 5257ef9 chore(deps): upgrade to ws@8.20.1 (#5439)
• 439a8f6 chore(release): engine.io@6.6.7
• fc11285 fix(eio): close HTTP requests with invalid content type
• Additional commits viewable in compare view

Updates @nestjs/graphql from 13.2.5 to 13.4.2

Release notes

Sourced from @​nestjs/graphql's releases.

v13.4.2 (2026-05-21)

Bug fixes

• graphql
  • #4007 fix(graphql): preserve PickType fields for dual-decorated inputs (@​yudin-s)

Committers: 1

• Serge Yudin (@​yudin-s)

v13.4.1

13.4.1 (2026-05-19)

Bug fixes

• apollo
  • #3999 fix(apollo): add granular control over HTTP status preservation for execution errors (@​thiagojv)
  • #3969 fix(@​nestjs/apollo): expose schema transform hook on gateway driver (@​maruthang)
• graphql
  • #3970 fix(@​nestjs/graphql): run plugin refresh hooks in registration order (@​maruthang)

Committers: 3

• Maruthan G (@​maruthang)
• Thiago Junqueira (@​thiagojv)
• Yogeshwaran C (@​yogeshwaran-c)

v13.4.0

13.4.0 (2026-04-30)

Features

• apollo, graphql, mercurius
  • #3811 feat(graphql): Add registerIn option for module-scoped type filtering (@​joe-re)

Bug fixes

• graphql
  • #3959 fix(@​nestjs/graphql): stop double-registering PickType inputs (@​yogeshwaran-c)
  • #3960 fix(@​nestjs/graphql): de-duplicate per-target metadata in TargetMetadataCollection (@​yogeshwaran-c)
• apollo, graphql
  • #3962 fix(@​nestjs/graphql): restore Timestamp scalar parsers in federation factory (@​yogeshwaran-c)

Enhancements

• graphql
  • #3963 fix(@​nestjs/graphql): validate registerEnumType/createUnionType options eagerly (@​yogeshwaran-c)

Dependencies

• graphql
  • #3954 fix(deps): update graphql-tools monorepo (@​renovate[bot])

Committers: 3

• Masato Noguchi (@​joe-re)
• Mateus Welter Goettems (@​mateuswgoettems)
• Yogeshwaran C (@​yogeshwaran-c)

... (truncated)

Commits

• c639ef8 v13.4.2
• ac5ed8b Merge pull request #4007 from yudin-s/fix/picktype-dual-decorated-input
• 0998d21 Merge pull request #4005 from nestjs/dependabot/npm_and_yarn/apollo/federatio...
• 9ce30f8 fix(graphql): preserve PickType fields for dual-decorated inputs
• 9001773 chore(deps): update dependency vitest to v4.1.7 (#4004)
• 5380a0e chore(deps): bump @​apollo/federation-internals from 2.11.2 to 2.14.0
• 6e939d3 Merge pull request #4002 from nestjs/dependabot/npm_and_yarn/fastify/static-9...
• 9b1fdd2 Merge pull request #4003 from nestjs/dependabot/npm_and_yarn/ws-8.20.1
• 764efbc chore: update serialized graph snapshot
• f57c31b chore(deps): bump ws from 8.18.0 to 8.20.1
• Additional commits viewable in compare view

Updates @nestjs/platform-ws from 11.1.19 to 11.1.24

Release notes

Sourced from @​nestjs/platform-ws's releases.

v11.1.24 (2026-05-25)

Bug fixes

• core
  • #17009 fix(core): reset dependency-tree cache on metadata changes (@​puneetdixit200)

Enhancements

• core
  • #16997 feat(core): warn on late websocket adapter registration (@​hbinhng)

Dependencies

• platform-ws
  • #17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@​dependabot[bot])

Committers: 2

• Nguyễn Hải Bình (@​hbinhng)
• Puneet Dixit (@​puneetdixit200)

v11.1.23 (2026-05-21)

Bug fixes

• core
  • nestjs/nest#16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.22 (2026-05-21)

Bug fixes

• core
  • #16993 fix(core): inflight request injection bug #16989 (@​kamilmysliwiec)

Enhancements

• core
  • #16967 fix(core): identify decorator type in invalid-class-module error (@​HarrierOnChain)

Committers: 2

• Harrier (@​HarrierOnChain)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.21 (2026-05-14)

Bug fixes

• core
  • #16948 fix(core): settle skipped provider initialization (@​yudin-s)

Committers: 1

• Serge Yudin (@​yudin-s)

... (truncated)

Commits

• d8a0ab8 chore(release): publish v11.1.24 release
• 7a105ad chore(deps): bump ws from 8.20.1 to 8.21.0
• 2dccece chore: update readmes
• b8be8c1 chore(release): publish v11.1.23 release
• 801c46f chore(release): publish v11.1.22 release
• 983dd52 chore(release): publish v11.1.21 release
• a0b0139 chore: update readme
• 7caeb3f chore(release): publish v11.1.20 release
• cfca26d chore(deps): bump ws from 8.20.0 to 8.20.1
• f6a3c2f fix(docs): update some old links in docs
• See full diff in compare view

Updates engine.io-client from 6.6.4 to 6.6.5

Release notes

Sourced from engine.io-client's releases.

engine.io-client@6.6.5

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Dependencies

• ws@~8.20.1 (diff)

Commits

• 8413bce chore(release): engine.io-client@6.6.5
• c10fe07 refactor(eio-client): improve JSDoc documentation
• 9349b14 refactor(eio-client): remove unused import
• ffe51e2 chore(release): engine.io@6.6.8
• f86b95f fix(eio): clean up resources upon WebTransport handshake failure
• 4276e59 refactor(eio): fix typo in the cookie option
• 5257ef9 chore(deps): upgrade to ws@8.20.1 (#5439)
• 439a8f6 chore(release): engine.io@6.6.7
• fc11285 fix(eio): close HTTP requests with invalid content type
• b059af6 refactor(eio): use plain IncomingMessage in the public API
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.