chore(deps): bump ws and viem

[dependabot]

Bumps ws to 8.21.0 and updates ancestor dependency viem. These dependencies need to be updated together.

Updates ws from 8.18.3 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• Additional commits viewable in compare view

Updates viem from 2.47.6 to 2.55.1

Release notes

Sourced from viem's releases.

viem@2.55.1

Patch Changes

• #4828 765e19b99b97567ef7b3446bc196353cdaa281a3 Thanks @​jxom! - Added Tempo zone encryption-key and deposit-status waiting actions, defaulted bounceback recipients to accounts, and adapted receipt polling for private Zone RPCs.

• #4823 c31e0bd376bf41250c1833cd741e9a93bfe75398 Thanks @​jxom! - Added blockHash and requireCanonical parameters to verifyHash, verifyMessage, verifyTypedData, and verifySiweMessage, allowing onchain signature verification to be pinned to a specific block via EIP-1898.

viem@2.55.0

Minor Changes

• #4817 2825f37bd4d9429a312dad378410d63c67feb0f8 Thanks @​davidperk! - Added depositNonce and depositReceiptVersion to OP Stack transaction receipts.

• #4822 0ef1b5d84abc6f03c4f7573ca5bab851593ccb2f Thanks @​tmm! - Added filterChains utility for filtering chain definitions by structured criteria.

Patch Changes

• #4809 c93d355d68f2ac98d5f139c963564651576793de Thanks @​defiQUG! - Added Defi Oracle Meta Mainnet chain.

• #4818 48324f72c057e5e52545e4672408af6bc9eeb60a Thanks @​cctdaniel! - Added Robinhood Chain and Robinhood Chain Testnet chains.

viem@2.54.6

Patch Changes

• #4807 f1ac4480d0c1c6f29bf709f116068e903643ecad Thanks @​jxom! - viem/tempo: Supported calling token .call builders without a Client (restores the pre-2.54 call signature). When the Client is omitted, token must be a TIP20 token id or contract address, and formatted amounts require explicit decimals.

viem@2.54.5

Patch Changes

• #4803 49fa5c885c5478e3e7a92411d7b309785df36974 Thanks @​jxom! - viem/tempo: Fixed fee-payer sponsorship for native multisig transaction preparation and serialization.

• #4805 5c0aae47181b13f58c7125542c13a2bc82f8662b Thanks @​jxom! - viem/tempo: Preserved sponsor-returned feeToken values from eth_fillTransaction responses with feePayerSignature.

viem@2.54.4

Patch Changes

• #4801 8d1db77e6379cfb4028cb8f0742b6633311fce43 Thanks @​jxom! - Added getRawTransaction action to retrieve a raw, serialized transaction via eth_getRawTransactionByHash.

viem@2.54.3

Patch Changes

• #4792 da4f54be6d3b5f5b0741e9ade94055685f9247c1 Thanks @​jxom! - viem/tempo: Added TIP-1061 multisig gas estimation hints (multisigInit, multisigSignatureCount), and attached multisigInit to multisig requests so node-side fill and estimation price bootstrap gas.

• #4792 da4f54be6d3b5f5b0741e9ade94055685f9247c1 Thanks @​jxom! - Updated ox to 0.14.30.

• #4791 515b637cde2d0338f012abfb501f1983440e4e76 Thanks @​jxom! - Fixed encodeAbiParameters and decodeAbiParameters handling of zero-width types (zero-length fixed arrays and empty tuples).

viem@2.54.2

Patch Changes

• #4742 71f8731a4cb0d569f7bc9453bc27e238f3f90c29 Thanks @​lifeofjer! - Added Mars Credit chain.

... (truncated)

Commits

• 61a40ec chore: version package (#4824)
• 388c148 test(tempo): skip unconfigured local zone tests (#4832)
• 765e19b feat(tempo): support current zone portals (#4828)
• fc32d40 ci: skip latest typescript benchmarks (#4829)
• 91a3e22 ci: report non-blocking wagmi failures (#4826)
• c31e0bd feat(verifyHash): add blockHash and requireCanonical params for onchain v...
• dc6150d chore: version package (#4812)
• 2825f37 feat(op-stack): add deposit receipt fields to OpStackTransactionReceipt (#4...
• 48324f7 feat: add Robinhood Chain and Robinhood Chain Testnet (#4818)
• 0ef1b5d feat(utils): filterChains API (#4822)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[jhfnetboy]

关闭理由:dependabot 只 bump 了 workspace 的 viem ^2.55.1 + lockfile,但未同步 root package.json 的 overrides(钉 2.47.6)——合入后任意一次 npm install 会让 override 与 lockfile 互搏(本仓依赖树靠 legacy-peer-deps + hoist 维稳,见 CLAUDE.md)。ws 8.18.3 已高于 GHSA 修复线、Security Audit 现为绿,无安全紧迫性。viem 升级将以受控 PR 处理:override+两 workspace+lockfile 三处同步 + SDK 兼容验证。

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.