fix: bumps ws to version 8.17.1 to fix CVE-2024-37890

[sordu]

refs:

• https://www.tenable.com/cve/CVE-2024-37890
• https://github.com/websockets/ws/releases/tag/8.17.1

The kind of change this PR does introduce

• a bug fix
• a new feature
• an update to the documentation
• a code change that improves performance
• other

Current behavior

Open CVE blocks auditing: #5051

New behavior

Bumps the websockt package to remove security issues

Other information (e.g. related issues)

[darrachequesne]

@sordu thanks!

[sordu]

@darrachequesne can we have a PATCH version release with this please? :)

[darrachequesne]

@sordu the current version imports "engine.io": "~6.5.2", so the latest version of ws should be properly installed when running npm update. Isn't that the case for you?

[sordu]

Thank you!

[darrachequesne]

@andrewaustin no, the lock file is only for local development (when you clone the socket.io repository), not when you install it from npm. Running npm update in your project should be sufficient.

[andrewaustin]

@darrachequesne npm update was not sufficient. Was able to reproduce multiple people on my team. npm 10.7.0. Not entirely sure the reason but npm remove and then npm install fixed it. Didn't seem to be a local issue because removing our pakage-lock.json and our node_modules did not resolve the issue.

Probably not worth you wasting any time on, since likely some npm, and package-lock weirdness.