fix(dts-plugin): update ws for CVE-2026-45736

[ScriptedAlchemy]

Summary

• Updates the direct dts-plugin ws dependency from 8.18.0 to 8.20.1.
• Refreshes pnpm-lock.yaml entries that resolved ws 8.18.0 to the patched 8.20.1 release.

Closes #4753

Validation

• corepack pnpm install --frozen-lockfile --lockfile-only --ignore-scripts
• corepack pnpm audit --prod --json checked for ws advisory visibility
• corepack pnpm --filter @module-federation/dts-plugin run test -- --runInBand attempted, but failed because workspace packages such as @module-federation/sdk and @module-federation/error-codes were not built and packages/dts-plugin/dist/core was absent in this fresh worktree.

Skipped checks

• Full package build/test/lint were not run to keep this dependency-only security PR scoped. The targeted dts-plugin test requires built workspace artifacts in this worktree.

[changeset-bot]

🦋 Changeset detected

Latest commit: 854bfbc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 46 packages

Name	Type
@module-federation/dts-plugin	Patch
@module-federation/cli	Patch
@module-federation/enhanced	Patch
@module-federation/manifest	Patch
@module-federation/metro	Patch
@module-federation/rspack	Patch
@module-federation/modern-js-v3	Patch
@module-federation/modern-js	Patch
@module-federation/nextjs-mf	Patch
@module-federation/node	Patch
@module-federation/rsbuild-plugin	Patch
@module-federation/rspress-plugin	Patch
@module-federation/storybook-addon	Patch
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
@module-federation/metro-plugin-rnc-cli	Patch
@module-federation/metro-plugin-rnef	Patch
@module-federation/metro-plugin-rock	Patch
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
node-dynamic-remote-new-version	Patch
node-dynamic-remote	Patch
remote5	Patch
remote6	Patch
website-new	Patch
@module-federation/runtime	Patch
@module-federation/webpack-bundler-runtime	Patch
@module-federation/sdk	Patch
@module-federation/runtime-tools	Patch
@module-federation/managers	Patch
@module-federation/third-party-dts-extractor	Patch
@module-federation/devtools	Patch
@module-federation/bridge-react	Patch
@module-federation/bridge-vue3	Patch
@module-federation/bridge-shared	Patch
@module-federation/bridge-react-webpack-plugin	Patch
@module-federation/retry-plugin	Patch
@module-federation/error-codes	Patch
@module-federation/inject-external-runtime-core-plugin	Patch
@module-federation/runtime-core	Patch
create-module-federation	Patch
@module-federation/treeshake-server	Patch
@module-federation/treeshake-frontend	Patch
@module-federation/esbuild	Patch
@module-federation/observability-plugin	Patch
@module-federation/utilities	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	854bfbc
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a16254073f72c00086b7897
😎 Deploy Preview	https://deploy-preview-4760--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@854bfbc

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@854bfbc

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@854bfbc

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@854bfbc

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@854bfbc

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@854bfbc

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@854bfbc

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@854bfbc

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@854bfbc

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@854bfbc

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@854bfbc

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@854bfbc

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@854bfbc

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@854bfbc

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@854bfbc

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@854bfbc

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@854bfbc

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@854bfbc

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@854bfbc

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@854bfbc

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@854bfbc

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@854bfbc

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@854bfbc

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@854bfbc

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@854bfbc

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@854bfbc

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@854bfbc

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@854bfbc

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@854bfbc

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@854bfbc

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@854bfbc

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@854bfbc

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@854bfbc

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@854bfbc

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@854bfbc

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@854bfbc

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@854bfbc

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@854bfbc

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@854bfbc

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@854bfbc

commit: 854bfbc

[github-actions]

Bundle Size Report

12 package(s) changed, 29 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/cli	26.3 kB	no change	786 B	no change
@module-federation/core	39.1 kB	no change	173 B	no change
@module-federation/devtools	664.0 kB	no change	4.0 kB	no change
@module-federation/enhanced	807.9 kB	no change	672 B	no change
@module-federation/managers	69.8 kB	no change	334 B	no change
@module-federation/manifest	136.1 kB	no change	182 B	no change
@module-federation/metro-plugin-rnc-cli	0 B	no change	314 B	no change
@module-federation/node	193.4 kB	no change	217 B	no change
@module-federation/runtime	20.0 kB	+13 B (+0.1%)	715 B	no change
@module-federation/runtime-core	287.4 kB	-8 B (-0.0%)	477 B	no change
@module-federation/storybook-addon	77.9 kB	no change	100 B	no change
@module-federation/utilities	110.6 kB	no change	328 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	-34 B (-1.4%)	2.3 kB	-34 B (-1.4%)
@module-federation/core	1.1 kB	-33 B (-2.9%)	1.0 kB	-32 B (-3.0%)
@module-federation/devtools	30.2 kB	-29 B (-0.1%)	30.2 kB	-29 B (-0.1%)
@module-federation/enhanced	2.6 kB	-46 B (-1.7%)	2.6 kB	-46 B (-1.7%)
@module-federation/managers	2.4 kB	-28 B (-1.1%)	2.4 kB	-28 B (-1.1%)
@module-federation/manifest	6.1 kB	-41 B (-0.7%)	6.1 kB	-41 B (-0.7%)
@module-federation/metro-plugin-rnc-cli	411 B	-27 B (-6.2%)	411 B	-27 B (-6.2%)
@module-federation/node	9.2 kB	-29 B (-0.3%)	9.2 kB	-29 B (-0.3%)
@module-federation/runtime	687 B	no change	687 B	no change
@module-federation/runtime-core	15.2 kB	no change	15.0 kB	no change
@module-federation/storybook-addon	1.9 kB	-24 B (-1.2%)	1.7 kB	-24 B (-1.3%)
@module-federation/utilities	2.6 kB	-33 B (-1.2%)	2.6 kB	-33 B (-1.2%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	21.4 kB	-18 B (-0.1%)	22.5 kB	-10 B (-0.0%)	+1.1 kB	+8 B

Total dist (raw): 6.78 MB (+5 B (+0.0%))
Total ESM gzip: 76.6 kB (no change)
Total web bundle (gzip): 205.4 kB (-324 B (-0.2%))
Total node bundle (gzip): 205.9 kB (-323 B (-0.2%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.