security: bump ws and concurrently to fix high/critical CVEs

[Vishnu-tppr]

We're bumping the versions of ws and concurrently to fix multiple CVEs in sub-dependencies. This drops our active vulnerabilities from 26 down to 11, and completely eliminates critical alerts.

Bumps:

• ws from ^8.20.0 to ^8.21.0 (resolves denial-of-service/memory leak vulnerabilities in the WebSocket parser).
• concurrently to ^10.0.3 (resolves prototype pollution in sub-packages).

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. Node engine mismatch 🐞 Bug ☼ Reliability

Description

The PR bumps concurrently to ^10.0.3, but the resolved concurrently@10.0.3 declares "engines.node"
>=22 while this repo’s CI uses Node 18/20. This mismatch can cause install-time engine warnings and
can break any invocation of concurrently (or its dependency chain) in CI/dev environments pinned to
Node 18/20.

Code

package.json[76]

+        "concurrently": "^10.0.3",

Evidence

The repo’s lockfile shows the bumped concurrently version requires Node >=22, but CI explicitly runs
Node 18/20, so the dependency’s declared supported runtime does not match the project’s CI runtime.

package-lock.json[1735-1756]
.github/workflows/ci.yml[9-27]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`concurrently` was bumped to `^10.0.3`, but the resolved version requires Node `>=22` while CI runs Node 18/20. This creates an engine mismatch that may break tooling when `concurrently` is invoked and may be promoted to failures in stricter environments.

### Issue Context
- `package-lock.json` resolves `concurrently@10.0.3` and declares `engines.node: ">=22"`.
- GitHub Actions CI matrix runs Node 18 and 20.

### Fix Focus Areas
- package.json[76-76]
- package-lock.json[1735-1756]
- .github/workflows/ci.yml[9-27]

### Suggested fix
Choose one:
1. Downgrade/pin `concurrently` to a version whose `engines.node` supports Node 18/20 (or remove it if unused).
2. If you truly want to require Node >=22, update CI/workflows to run Node 22+ and optionally add a top-level `engines` field in `package.json` to make the requirement explicit.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[qodo-code-review]

PR Summary by Qodo

Security: bump ws and concurrently to address high/critical CVEs
⚙️ Configuration changes 🕐 Less than 5 minutes

Walkthroughs

Description

• Bump ws to ^8.21.0 to remediate WebSocket parser DoS/memory issues.
• Bump concurrently to ^10.0.3 to remediate prototype-pollution issues in sub-deps.

Diagram

graph TD
  A["package.json"] --> B["ws"]
  A["package.json"] --> C["concurrently"]
  B --> D["Runtime networking"]
  C --> E["Dev scripts"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use npm overrides/resolutions (temporary mitigation)

• ➕ Can remediate vulnerable transitive packages without changing top-level versions
• ➕ Useful if a direct bump is blocked by breaking changes
• ➖ Adds long-term maintenance burden and can mask required upgrades
• ➖ May create harder-to-debug dependency graph drift across environments

2. Enable automated dependency PRs (Renovate/Dependabot)

• ➕ Reduces time-to-fix for future CVEs
• ➕ Provides consistent upgrade cadence and visibility
• ➖ Requires tuning to avoid noisy PR volume
• ➖ Still needs CI coverage to ensure upgrades are safe

Recommendation: The PR’s approach (bumping the direct dependencies) is the preferred long-term fix versus relying on overrides. Ensure the corresponding lockfile is updated in the PR (if applicable) and verify CI/test runs plus an npm audit (or your security scanner) reflect the reduced/cleared critical/high findings.

File Changes

Other (1)

package.json Bump ws and concurrently to patched versions +2/-2

Bump ws and concurrently to patched versions

• Updates the ws dependency from ^8.20.0 to ^8.21.0 and concurrently devDependency from ^9.2.1 to ^10.0.3 to address reported CVEs in these packages and their sub-dependencies.

package.json

---