chore(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /frontend/webcoder_ui

[dependabot]

Bumps websocket-driver from 0.7.4 to 0.7.5.

Changelog

Sourced from websocket-driver's changelog.

0.7.5 / 2026-06-04

• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Fail the connection if a message is larger than the configured max length after extension processing

Commits

• 5d6a9aa Bump version to 0.7.5
• c55679a Fail the connection if a message is larger than the configured max length aft...
• 5b197ca Close a draft-75/76 connection if a length header grows to exceed the configu...
• fc93a48 Test on Node v22, v24, and v26
• 2e82d34 Test on recent versions of Node
• e4962db Switch from Travis CI to GitHub Actions
• 3f2f9b7 Travis update: cache npm modules, remove sudo, run on Node 15
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: area:ci, type:chore. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[Prekzursil]

PR-specific note (#98 — highest priority of the four). This PR is the fix for the only CRITICAL alert in the repo: GHSA-xv26-6w52-cph6 (CVSS 9.2) plus GHSA-mp7j-qc5w-4988, both websocket-driver 0.7.4 -> 0.7.5. Its lock delta also carries ws 7.5.11 -> 7.5.12, which does NOT satisfy the 7.5.13 the ideal tree now wants, so it does not by itself resolve Blocker 2 below.

Its own quality run additionally died on a THIRD, transient cause, unrelated to the two below — step 9 Install opengrep: Error: Failed to fetch available versions from GitHub. That is infrastructure flake and would clear on a re-run.

---

Diagnosis: left OPEN. This PR is unique and still wanted, but it is blocked by two repo-level defects on main, neither of which this PR causes or can fix.

Blocker 1 — the required quality / quality check cannot pass for any PR.
It fails at step 20, gate-deps osv-scanner. osv-scanner exits 1 on ANY finding,
so the gate is all-or-nothing. Measured locally against a clean clone of main
(osv-scanner 2.3.8, the same version CI pins):

Total 17 packages affected by 25 known vulnerabilities
  (1 Critical, 14 High, 9 Medium, 1 Low) from 2 ecosystems

That set is NOT closable by bounded-floor bumps, so it is an owner call:

• react-router / react-router-dom 6.30.4 — GHSA-jjmj-jmhj-qwj2 has no
  patched 6.x at all. The advisory records introduced 6.30.2 / last_affected 6.30.4 for react-router-dom, and the fix lands only in
  react-router 7.13.0. Clearing it therefore requires a react-router v6 -> v7
  major migration, which is a runtime-dependency change with real app impact,
  not a dependency-hygiene bump.
• svgo 1.3.2 -> 2.8.3 and brace-expansion -> 5.0.8 are also cross-major.
  Note that forcing brace-expansion 5.x is NOT safe here on its own: 5.x
  exports { EXPANSION_MAX, EXPANSION_MAX_LENGTH, expand } with no callable
  module and no default export, while minimatch 3.x/9.x call the module
  directly — measured TypeError: expand is not a function. The consumer has to
  move up (glob/minimatch), not the dependency down.

Blocker 2 — npm ci is broken on main, so verify fails independently.
Reproduced locally on a clean clone of main with no PR applied:

npm error code EUSAGE
npm error Invalid: lock file's ws@7.5.11 does not satisfy ws@7.5.13
npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json ... are in sync.

frontend/webcoder_ui/package.json overrides ws to ^7.5.11; since the lock
was written, 7.5.13 published, so the resolved ideal tree wants 7.5.13 while the
lock still pins 7.5.11. This is a pre-existing main defect (a caret override
drifting), not anything this PR did, and it blocks verify on every PR in the
repo. Fix is a lockfile refresh (npm install in frontend/webcoder_ui)
committed to main.

Note main's last recorded green quality run is 477b7ae from 2026-06-27, which
predates all 25 of these advisories — so main is stale-green, not actually green.

No action taken on this PR beyond this comment: it carries a real, unique change
and should survive.