chore(deps): bump ws and @wp-playground/cli

[dependabot]

Bumps ws and @wp-playground/cli. These dependencies needed to be updated together.
Updates ws from 8.18.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• Additional commits viewable in compare view

Updates @wp-playground/cli from 3.1.34 to 3.1.46

Release notes

Sourced from @​wp-playground/cli's releases.

WordPress Playground v3.1.46

Blueprints

• Declare v2 schema constraints beside their types. (#4077)

Documentation

• [Docs] Describe Playground tools with the Dock UI. (#4085)
• [Docs] Document Dock paths in Blueprint and API documentation. (#4083)

PHP WebAssembly

• [CLI] Use preferredVersions.wp in Playground CLI. (#4075)
• Harden non-streaming fallback tests for fetchWithCorsProxy. (#3495)
• [PHP-WASM] Expose recursive cp through PHPWorker. (#4061)

Website

• Add a square mobile Dock with a tools toggle. (#4088)
• Add end-to-end coverage for playground-zip import regressions. (#3874)
• Align mobile Dock pane titles, toolbars, and forms. (#4084)
• Anchor the autosave nudge to the Playgrounds Dock button. (#4096)
• Ask before reloading edited Blueprint fragments. (#4089)
• Clarify New Playground action labels. (#4090)
• Decode JSON-encoded <php-snippet> child payloads. (#4101)
• Keep the file editor Save control stable during autosave. (#4073)
• Make Playgrounds pane rows span the Dock width. (#4086)
• Match local-directory status to the autosave callout. (#4100)
• Name Dock pane state after the Dock. (#4080)
• Place Dock panes above the visible collapsed row. (#4112)
• Render error dialogs as Quiet Paper sheets. (#4102)
• Restyle the GitHub connect prompt to match the Dock. (#4094)
• Use outward glyph for Dock Export. (#4091)

Contributors

The following contributors merged PRs in this release:

@​adamziel @​ashfame

---

Install via npm:

npm install @wp-playground/client@3.1.46

Or browse all packages on npm.

... (truncated)

Changelog

Sourced from @​wp-playground/cli's changelog.

[v3.1.46] (2026-07-20)

Blueprints

• Declare v2 schema constraints beside their types. (#4077)

Documentation

• [Docs] Describe Playground tools with the Dock UI. (#4085)
• [Docs] Document Dock paths in Blueprint and API documentation. (#4083)

PHP WebAssembly

• [CLI] Use preferredVersions.wp in Playground CLI. (#4075)
• Harden non-streaming fallback tests for fetchWithCorsProxy. (#3495)
• [PHP-WASM] Expose recursive cp through PHPWorker. (#4061)

Website

• Add a square mobile Dock with a tools toggle. (#4088)
• Add end-to-end coverage for playground-zip import regressions. (#3874)
• Align mobile Dock pane titles, toolbars, and forms. (#4084)
• Anchor the autosave nudge to the Playgrounds Dock button. (#4096)
• Ask before reloading edited Blueprint fragments. (#4089)
• Clarify New Playground action labels. (#4090)
• Decode JSON-encoded <php-snippet> child payloads. (#4101)
• Keep the file editor Save control stable during autosave. (#4073)
• Make Playgrounds pane rows span the Dock width. (#4086)
• Match local-directory status to the autosave callout. (#4100)
• Name Dock pane state after the Dock. (#4080)
• Place Dock panes above the visible collapsed row. (#4112)
• Render error dialogs as Quiet Paper sheets. (#4102)
• Restyle the GitHub connect prompt to match the Dock. (#4094)
• Use outward glyph for Dock Export. (#4091)

Contributors

The following contributors merged PRs in this release:

@​adamziel @​ashfame

[v3.1.45] (2026-07-16)

Enhancements

• [Website] Add a file editor end-to-end test harness. (#3978)

Blueprints

... (truncated)

Commits

• 581c7c1 v3.1.46
• 291fffd [Website] Place Dock panes above the visible collapsed row (#4112)
• 2ef1024 [Website] Add E2E coverage for playground-zip import regressions (#3874)
• e563511 Recompile WordPress major and beta versions
• 8917cb4 Harden non-streaming fallback tests for fetchWithCorsProxy (#3495)
• 490edeb [Website] Render error dialogs as Quiet Paper sheets (#4102)
• 1a23831 [Website] Match local-directory status to the autosave callout (#4100)
• 6c8dde4 [Website] Decode JSON-encoded <php-snippet> child payloads (#4101)
• a67022a [Website] Anchor the autosave nudge to the Playgrounds Dock button (#4096)
• b2b6983 [PHP-WASM] Expose recursive cp through PHPWorker (#4061)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8465c88

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coveralls]

Coverage Report for CI Build 29789071560

Coverage remained the same at 59.571%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	720
Covered Lines:	484
Line Coverage:	67.22%
Relevant Branches:	445
Covered Branches:	210
Branch Coverage:	47.19%
Branches in Coverage %:	Yes
Coverage Strength:	6.8 hits per line

---

💛 - Coveralls