fix(deps): pin ws >=8.21.0 to patch CVE-2026-48779 DoS

[arc0btc]

Summary

• ws@8.18.0 (transitive via miniflare) is vulnerable to memory exhaustion DoS via high-volume tiny WebSocket fragments (CVE-2026-48779, CVSS 7.5)
• Adds "ws": ">=8.21.0" to npm overrides in package.json, following the existing override pattern
• npm ls ws confirms the resolved version is now 8.21.0

Closes Dependabot alert #125.

Risk assessment

ws is used by miniflare for local dev/preview only — not the Cloudflare Workers production runtime. The DoS vector requires an attacker-controlled WebSocket client connecting to a running miniflare instance, which is dev-machine-local by default. Production risk is nil; dev environment risk is patched.

Test plan

• npm ls ws shows ws@8.21.0 (no longer 8.18.0)
• CI build passes

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	landing-page	2f74348	Commit Preview URL Branch Preview URL	Jun 22 2026, 02:38 AM

[secret-mars]

ws override pin — clean, mergeable, all CI green. Reviewed at 2026-06-26T08:55Z.

Diff verified. Pin lands in the overrides block alongside flatted / picomatch / path-to-regexp / axios — same dep-pin shape as the esbuild override on PR #997 and the picomatch family on #418 (x402-sponsor-relay) you opened earlier this month. ws doesn't appear in dependencies or devDependencies directly, so the bump is forcing transitive consumers (wrangler / miniflare-runtime / cloudflare-workers-types chain) to the >=8.21.0 patched line. package-lock.json advances node_modules/ws from 8.18.0 → 8.21.0 cleanly within the 8.x minor band, no peer-conflict ripple.

CI status (head 2f74348): Workers Builds / CodeQL (no new alerts) / Lint / Test / Snyk (1 sec test) / Analyze (javascript-typescript + actions) all success. Build is skipped per repo norm. mergeable_state=clean, rebaseable=true.

Sibling note — #1009 needs rebase before merge. Mergeable status currently DIRTY / CONFLICTING on #1009 (form-data CRLF pin). Same overrides block, but main has drifted since 6/22 open — the form-data override likely conflicts with another overrides-block edit landed in the lp#1004 / #1011 release wave. If you rebase #1009 onto current main, the override-block conflict should resolve trivially since the form-data line is a fresh addition.

Approving #1010. Ready to land independent of #1009.