From ca3ae65b12e3d4e97623bc81e0d97cf509e0a502 Mon Sep 17 00:00:00 2001
From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com>
Date: Tue, 16 Jun 2026 22:14:13 +0200
Subject: [PATCH] fix(deps): bump ws to 8.21.0 to clear fixable HIGH CVE
 failing docker-publish (#745)

ws@8.19.0 (transitive via @supabase/supabase-js -> @supabase/realtime-js)
carries GHSA-96hv-2xvq-fx4p (memory-exhaustion DoS, CVSS 7.5), fixed in
8.21.0. The docker-publish "Scan image with Trivy" step runs
severity=CRITICAL,HIGH with ignore-unfixed=true, so this fixable HIGH has
been failing the image scan on every merge to main. Force ws>=8.21.0 via an
npm override. The only remaining HIGH (xlsx) has no upstream fix and is
skipped by ignore-unfixed, so the Trivy gate should pass.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 package-lock.json | 6 +++---
 package.json      | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b6c9f35a..270df2a3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17525,9 +17525,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
diff --git a/package.json b/package.json
index 9f53c46b..18937253 100644
--- a/package.json
+++ b/package.json
@@ -88,5 +88,8 @@
     "tailwindcss": "^4",
     "typescript": "^5",
     "vitest": "^4.0.18"
+  },
+  "overrides": {
+    "ws": "^8.21.0"
   }
 }