[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-58qx-3vcg-4xpx	ws	None	8.18.3	8.21.0		confirmed

Not Included

• Deferred by batch limit: 51 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	handlebars	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	handlebars	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	protobufjs	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Lockfile-only dependency patch bump with no application code changes; low regression risk aside from normal WebSocket client behavior differences in ws.

Overview
Bumps the direct ws dependency from ^8.18.3 to ^8.21.0 and refreshes pnpm-lock.yaml so the resolved version is 8.21.0.

This addresses GHSA-58qx-3vcg-4xpx as part of the Socket vulnerability remediation workflow. No source or API changes are included—only the manifest and lockfile.

^{Reviewed by Cursor Bugbot for commit a79e2e9. Bugbot is set up for automated code reviews on this repo. Configure here.}