[MelvinBot]

Details

Fixes ws Dependabot alerts (GHSA-96hv-2xvq-fx4p, GHSA-3h5v-q93c-6h6q) with a lockfile-only bump:

• ws 7.5.9 → 7.5.13 (under metro, metro-inspector-proxy, @react-native-community/cli-server-api, react-devtools-core)
• ws 6.2.2 → 6.2.6 (under react-native)

Usage: Not used by our code. It's a transitive dep of the react-native peer, used only by the Metro dev server, the debugger proxy, and React DevTools websockets. It isn't in the published package.

Change Log

7.5.10 / 6.2.3: Fixed a DoS when handling a request with many HTTP headers.
7.5.11 / 6.2.4: Fixed memory exhaustion DoS from tiny fragments and data chunks.
7.5.12 / 6.2.5: Backported more fragment and data-chunk limit fixes.
7.5.13 / 6.2.6: Fixed a bug from 7.5.12 / 6.2.5 that prevented the fragment counter from resetting.

Related Issues

$ https://github.com/Expensify/Expensify/issues/695873

Manual Tests

1. npm ci succeeds.
2. npm ls ws --all shows only 7.5.13 and 6.2.6.
3. npm run ts and npm run build pass.

Linked PRs

None.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR