chore(deps): bump ws from 8.20.0 to 8.20.1

[dependabot]

Bumps ws from 8.20.0 to 8.20.1.

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

Commits

• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• See full diff in compare view

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This is a security patch bump. ws 8.20.1 fixes an uninitialized memory disclosure where passing a TypedArray (e.g. Float32Array) as the reason argument to websocket.close() could leak uninitialized memory to remote peers. The change is limited to the lock file and packages/server/package.json — no application code modified.

Files Reviewed (2 files)

• package-lock.json — ws version bump 8.20.0 → 8.20.1, integrity hash updated
• packages/server/package.json — dependency range updated to ^8.20.1

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 80,235 tokens}