fix(deps): resolve patched ws via in-range bumps instead of an override

[simonholmes]

Follow-up to #39. Replaces the ws override with the fix the package authors intended.

Why the override was the wrong shape

#39 patched GHSA-96hv-2xvq-fx4p with "ws": "^8.21.0" in overrides. That worked, but engine.io@6.6.8 and socket.io-adapter@2.5.7 declare ws: ~8.20.1 — a tilde range that excludes 8.21.x. The override forced them past a constraint their authors set deliberately.

The test suite passing was weak evidence it was safe: socket.io reaches us only through react-email, so nothing in our 20,942 tests performs a websocket handshake. A green run wouldn't have told us either way.

The fix

Both packages have since published patch releases that widen the range to ~8.21.0 specifically to pick up patched ws:

Package	Before	After	ws range
engine.io	6.6.8	6.6.9	~8.20.1 → ~8.21.0
socket.io-adapter	2.5.7	2.5.8	~8.20.1 → ~8.21.0

Both land inside socket.io@4.8.3's own declared ranges (engine.io: ~6.6.0, socket.io-adapter: ~2.5.2), so this is an ordinary in-range update — nothing is forced.

ws now hoists to 8.21.2 on its own, satisfying every consumer natively:

jsdom             ^8.18.0   ✅
openai            ^8.18.0   ✅
happy-dom         ^8.21.0   ✅
engine.io         ~8.21.0   ✅   (was ~8.20.1)
socket.io-adapter ~8.21.0   ✅   (was ~8.20.1)

Diff

Two lockfile lines, and one fewer override:

 "overrides": {
   "hono": "^4.11.7",
-  "valibot": "^1.2.0",
-  "ws": "^8.21.0"
+  "valibot": "^1.2.0"
 }

Also one less thing to conflict on the next upstream sync.

Verification

• Clean npm ci → single deduped ws@8.21.2, no override in play
• type-check, lint, format:check clean
• 1040 test files, 20,942 tests passed
• npm run build exit 0, 174 static pages generated
• Audit parity with main: 8 total / 6 high, byte-identical set — adm-zip, epub2, next, postcss, sharp, @react-email/ui. None is ws. This change removes the ws problem and touches nothing else.

Upstream

Reported as human-centric-engineering/sunrise#538 with this same transitive-bump fix recommended, plus a note that dependency-review-action is diff-based and so structurally cannot catch a vulnerable version already sitting on main — it only fires in a fork, on the sync PR.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hce-website	Ready	Preview	Aug 5, 2026 12:46pm