chore(deps): bump ws and engine.io-client in /frontend

[dependabot]

Bumps ws and engine.io-client. These dependencies needed to be updated together.
Updates ws from 8.19.0 to 8.20.1

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

8.20.0

Features

• Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).

Commits

• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• 3ee5349 [api] Convert the isServer and maxPayload parameters to options
• 91707b4 [doc] Add missing space
• 8b55319 [pkg] Update eslint to version 10.0.1
• Additional commits viewable in compare view

Updates engine.io-client from 6.6.4 to 6.6.5

Release notes

Sourced from engine.io-client's releases.

engine.io-client@6.6.5

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Dependencies

• ws@~8.20.1 (diff)

Commits

• 8413bce chore(release): engine.io-client@6.6.5
• c10fe07 refactor(eio-client): improve JSDoc documentation
• 9349b14 refactor(eio-client): remove unused import
• ffe51e2 chore(release): engine.io@6.6.8
• f86b95f fix(eio): clean up resources upon WebTransport handshake failure
• 4276e59 refactor(eio): fix typo in the cookie option
• 5257ef9 chore(deps): upgrade to ws@8.20.1 (#5439)
• 439a8f6 chore(release): engine.io@6.6.7
• fc11285 fix(eio): close HTTP requests with invalid content type
• b059af6 refactor(eio): use plain IncomingMessage in the public API
• Additional commits viewable in compare view

---

Note

Low Risk
Lockfile-only dependency upgrades with a low-severity security patch; no app logic changes.

Overview
Updates frontend lockfile dependencies so ws resolves to 8.20.1 (from 8.18.3) and engine.io-client to 6.6.5, which pulls the matching ws range. The nested Storybook copy of ws @ 8.19.0 is dropped in favor of the hoisted 8.20.1 tree.

This is driven by a websocket.close() uninitialized-memory disclosure fix in ws (CVE-2026-45736); no application source changes.

^{Reviewed by Cursor Bugbot for commit 41349d9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ joanagmaia
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.