Bump ws and netlify-cli

[dependabot]

Bumps ws to 8.21.1 and updates ancestor dependency netlify-cli. These dependencies need to be updated together.

Updates ws from 8.19.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Updates netlify-cli from 24.8.1 to 26.2.0

Release notes

Sourced from netlify-cli's releases.

v26.2.0

26.2.0 (2026-07-06)

Features

• add watch-ignore flag (#8271) (fc30bcc)

Bug Fixes

• add a stacktrace for monitoring (#8301) (30ba6a1)
• add commandname to error reporting (#8303) (004df96)
• deps: replace lodash with native utilities (#8189) (137fbf0)
• deps: update dependency @​netlify/blobs to ^10.7.9 (#8291) (419a749)
• deps: update dependency @​netlify/dev to ^4.18.7 (#8292) (1985b3b)
• deps: update dependency @​netlify/dev-utils to ^4.4.6 (#8293) (392af83)
• deps: update dependency @​netlify/edge-functions to ^3.0.8 (#8295) (7d00215)
• deps: update dependency @​netlify/functions to ^5.3.0 (#8296) (42393a4)
• deps: update dependency @​netlify/images to ^1.3.10 (#8298) (20fb23d)
• dev: execute dev command with shell operators (&&, ||, etc.) (#8234) (d07599e)
• silence zip output when creating source zips (#8323) (e6fbebc)

v26.1.0

26.1.0 (2026-05-31)

Features

• add support for new function config properties (#8278) (826fde7)

Bug Fixes

• deps: remove uuid dependency (#8275) (4f2a96b)
• deps: replace extract-zip and update Netlify packages (#8277) (c078a98)
• deps: update dependency @​netlify/blobs to ^10.7.7 (#8252) (dfcc0a2)
• infinite loop on error (#8269) (a3549b8)
• user sending the wrong command is not an error (#8270) (21fe038)

v26.0.2

26.0.2 (2026-05-15)

Bug Fixes

• deps: unpin all dependencies (#8171) (47da71e)
• deps: update dependency @​netlify/blobs to ^10.7.5 (#8245) (54a2334)
• deps: update dependency @​netlify/dev to ^4.18.3 (#8246) (7141b22)
• deps: update dependency @​netlify/dev to ^4.18.4 (#8253) (0a70cf4)

... (truncated)

Changelog

Sourced from netlify-cli's changelog.

26.2.0 (2026-07-06)

Features

• add watch-ignore flag (#8271) (fc30bcc)

Bug Fixes

• add a stacktrace for monitoring (#8301) (30ba6a1)
• add commandname to error reporting (#8303) (004df96)
• deps: replace lodash with native utilities (#8189) (137fbf0)
• deps: update dependency @​netlify/blobs to ^10.7.9 (#8291) (419a749)
• deps: update dependency @​netlify/dev to ^4.18.7 (#8292) (1985b3b)
• deps: update dependency @​netlify/dev-utils to ^4.4.6 (#8293) (392af83)
• deps: update dependency @​netlify/edge-functions to ^3.0.8 (#8295) (7d00215)
• deps: update dependency @​netlify/functions to ^5.3.0 (#8296) (42393a4)
• deps: update dependency @​netlify/images to ^1.3.10 (#8298) (20fb23d)
• dev: execute dev command with shell operators (&&, ||, etc.) (#8234) (d07599e)
• silence zip output when creating source zips (#8323) (e6fbebc)

26.1.0 (2026-05-31)

Features

• add support for new function config properties (#8278) (826fde7)

Bug Fixes

• deps: remove uuid dependency (#8275) (4f2a96b)
• deps: replace extract-zip and update Netlify packages (#8277) (c078a98)
• deps: update dependency @​netlify/blobs to ^10.7.7 (#8252) (dfcc0a2)
• infinite loop on error (#8269) (a3549b8)
• user sending the wrong command is not an error (#8270) (21fe038)

26.0.2 (2026-05-15)

Bug Fixes

• deps: unpin all dependencies (#8171) (47da71e)
• deps: update dependency @​netlify/blobs to ^10.7.5 (#8245) (54a2334)
• deps: update dependency @​netlify/dev to ^4.18.3 (#8246) (7141b22)
• deps: update dependency @​netlify/dev to ^4.18.4 (#8253) (0a70cf4)
• deps: update dependency @​netlify/functions to ^5.2.1 (#8254) (5d11c29)
• deps: update dependency uuid to v13.0.1 [security] (#8193) (b267a5e)
• deps: update netlify packages (#8247) (0875c46)

... (truncated)

Commits

• 7c10162 chore(main): release 26.2.0 (#8290)
• 3c41e72 test: fix edge functions watch-ignore path assertions on Windows (#8327)
• e6fbebc fix: silence zip output when creating source zips (#8323)
• 137fbf0 fix(deps): replace lodash with native utilities (#8189)
• d0fb528 chore(deps): update dependency @​fastify/static to v9.1.3 (#8319)
• 4e919e2 chore(deps): update dependency http-proxy-middleware to v3.0.7 [security] (#8...
• 5585c33 chore(deps): update actions/create-github-app-token action to v2.2.2 (#8302)
• 004df96 fix: add commandname to error reporting (#8303)
• 77982eb chore(deps): update dependency form-data to v4.0.6 [security] (#8308)
• 35d52f5 chore(deps): combined dependency bumps (#8297, #8242, #8299) (#8304)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.