fix(deps): bump ws to 8.21.0 to clear fixable HIGH CVE failing docker-publish (#745)

ws@8.19.0 (transitive via @supabase/supabase-js -> @supabase/realtime-js)
carries GHSA-96hv-2xvq-fx4p (memory-exhaustion DoS, CVSS 7.5), fixed in
8.21.0. The docker-publish "Scan image with Trivy" step runs
severity=CRITICAL,HIGH with ignore-unfixed=true, so this fixable HIGH has
been failing the image scan on every merge to main. Force ws>=8.21.0 via an
npm override. The only remaining HIGH (xlsx) has no upstream fix and is
skipped by ignore-unfixed, so the Trivy gate should pass.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

Jakob Wennberg

2026-06-16 22:14:13 +02:00

committed by

GitHub

co-authored by

Claude Opus 4.8

parent 2a8bf9b42e

commit ca3ae65b12

2 changed files with 6 additions and 3 deletions

									
										package.json
									
		+3
		
												View File
												
				@@ -88,5 +88,8 @@

				    "tailwindcss": "^4",

				    "typescript": "^5",

				    "vitest": "^4.0.18"

				  },

				  "overrides": {

				    "ws": "^8.21.0"

				  }

				}