Bump ws from 6.2.2 to 6.2.3 in /controlpanel

[dependabot]

Bumps ws from 6.2.2 to 6.2.3.

Release notes

Sourced from ws's releases.

6.2.3

Bug fixes

• Backported e55e5106 to the 6.x release line (eeb76d31).

Commits

• d87f3b6 [dist] 6.2.3
• eeb76d3 [security] Fix crash when the Upgrade header cannot be read (#2231)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[mariacarmina]

@dependabot rebase

[alexcos20]

@dependabot rebase

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, opened by Dependabot, updates the ws package versions within the controlpanel/package-lock.json file. Specifically, it bumps ws from 6.2.2 to 6.2.3 in some nested dependencies (e.g., @react-native/dev-middleware) and from 7.5.9 to 7.5.10 in others (e.g., @react-native-community/cli-server-api). These are patch version updates, typically containing bug fixes or minor improvements, and are generally safe.

Comments:
No inline comments could be generated (missing file paths or line numbers).

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, opened by Dependabot, updates the ws (WebSockets) package to patch versions 6.2.3 and 7.5.10 within the /controlpanel directory's package-lock.json. These are minor, non-breaking updates primarily addressing bug fixes or small improvements, and also include the addition of the MIT license declaration for the updated packages.

Comments:
• [INFO][other] This PR updates the ws package. Specifically, node_modules/@react-native/dev-middleware/node_modules/ws and node_modules/react-native/node_modules/ws are updated from 6.2.2 to 6.2.3. Other instances like node_modules/@react-native-community/cli-server-api/node_modules/ws and node_modules/metro/node_modules/ws are updated from 7.5.9 to 7.5.10.
• [INFO][other] It's noted that different transitive dependencies in the project are relying on different major versions of ws (v6 and v7). While this update bumps both to their latest patch, it might be beneficial in the long run to consolidate to a single major version of ws if possible, to reduce dependency surface area and potential conflicts, though this is outside the scope of a Dependabot patch update.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the ws dependency to patch versions across several sub-dependencies within the /controlpanel directory. Specifically, ws is updated from 6.2.2 to 6.2.3 for some instances (e.g., those nested under react-native) and from 7.5.9 to 7.5.10 for others (e.g., under metro, @react-native-community/cli-server-api).

Additionally, the package-lock.json shows the inclusion of multiple platform-specific optional @parcel/watcher native modules, which is a common occurrence when dependency resolution is re-run and new prebuilds are discovered or chosen. The optional dependency utf-8-validate, which provides faster UTF-8 validation for ws, has been removed from the lockfile. This typically means the native module either failed to build or was not resolved in the environment where the lockfile was generated; ws will fall back to a JavaScript implementation without it, which might result in a minor performance impact but no functional regression.

Given that these are patch version updates for ws, the risk is considered low. The changes primarily involve bug fixes and minor improvements in the ws library itself, and the removal of utf-8-validate is for an optional performance optimization rather than a critical dependency.

Comments:
• [INFO][other] The ws dependency nested under @react-native/dev-middleware and react-native is updated from 6.2.2 to 6.2.3. This is a patch version update and generally safe, addressing minor bug fixes in ws.
• [INFO][other] Multiple instances of ws (e.g., under metro, @react-native-community/cli-server-api, @walletconnect/jsonrpc-ws-connection, react-devtools-core) are updated from 7.5.9 to 7.5.10. These are also patch version updates, typically including minor bug fixes or non-breaking changes.
• [INFO][other] Several new optional @parcel/watcher native modules for various platforms have been added to the lockfile. This is a common pattern for build tools like Parcel to include prebuilt native modules for performance. This change is likely a side-effect of running npm update and is generally not a concern unless specific build issues arise.
• [INFO][performance] The utf-8-validate dependency has been removed. This package provides a C++ binding for faster UTF-8 validation, used as an optional performance optimization by ws. Its absence means ws will fall back to a JavaScript implementation for UTF-8 validation. This might incur a minor performance overhead for heavy WebSocket usage but should not lead to functional issues.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the ws dependency to 6.2.3 (from 6.2.2) and 7.5.10 (from 7.5.9) in various transitive dependencies within the /controlpanel directory's package-lock.json. It also includes the addition of several optional platform-specific @parcel/watcher packages and the removal of utf-8-validate from the top-level node_modules list. These are standard dependency maintenance updates, typically involving bug fixes and minor improvements, and are generated by Dependabot.

Comments:
• [INFO][other] Multiple optional @parcel/watcher packages for various platforms are added. This is a common pattern in package-lock.json files when tooling like Parcel is used, as it lists all potential platform-specific native modules. This is expected behavior and should not cause issues.
• [INFO][other] The utf-8-validate package is removed from the root node_modules section. This is likely due to the updated ws versions (6.2.3 and 7.5.10) either integrating its functionality directly, using a different package for validation, or managing it as a nested dependency more explicitly. The ws changelog for 7.5.10 mentions bumping utf-8-validate, so it's likely still used but nested under ws.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, generated by Dependabot, updates the ws (WebSockets) package within the /controlpanel directory's package-lock.json. It specifically bumps ws from 6.2.2 to 6.2.3 and from 7.5.9 to 7.5.10 in various transitive dependency paths. These updates include important security fixes that address Denial of Service (DoS) vulnerabilities in the ws library (e.g., CVE-2022-29244). The PR also includes the addition of various @parcel/watcher-* optional native modules and the removal of the utf-8-validate optional dependency, which are common side effects of dependency resolution updates.

Comments:
• [INFO][security] This PR updates ws to versions 6.2.3 and 7.5.10 across several transitive dependencies. These updates address known Denial of Service (DoS) vulnerabilities, such as CVE-2022-29244. This is a crucial security enhancement.
• [INFO][performance] The optional native dependency utf-8-validate has been removed. This package typically provides performance enhancements for WebSocket operations. While ws will fall back to a JavaScript implementation, a slight performance impact could theoretically be observed, though it's likely minor for a control panel application.
• [INFO][other] Multiple @parcel/watcher-* native modules have been added to the lock file. These are optional dependencies for file watching and are likely a result of updates to a build tool or related dependency. This change is expected and generally harmless.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request updates the ws dependency to patch versions in the controlpanel directory. Specifically, ws is updated from 6.2.2 to 6.2.3 and from 7.5.9 to 7.5.10. The 7.5.10 update includes a security fix. Additionally, the package-lock.json reflects the addition of several optional @parcel/watcher platform-specific native modules and the removal of the utf-8-validate optional dependency, which are typical changes for lockfiles after dependency updates.

Comments:
• [INFO][security] The ws package in node_modules/@react-native/dev-middleware/node_modules/ws has been updated from 6.2.2 to 6.2.3. This is a patch release fixing a minor bug, as per its release notes.
• [INFO][security] The ws package in node_modules/@react-native-community/cli-server-api/node_modules/ws (and other node_modules/ws instances) has been updated from 7.5.9 to 7.5.10. The release notes for 7.5.10 indicate a security fix (security: update dependencies), which is a beneficial update.
• [INFO][other] Several optional @parcel/watcher-* native modules have been added to the package-lock.json. This is common behavior for npm install when dealing with dependencies that include native modules, as it locks down all possible platform-specific versions. These modules are optional and only installed if required by the target environment, so their presence in the lockfile is generally harmless.
• [INFO][other] The utf-8-validate optional dependency has been removed. This package is often used by ws for performance optimizations. Its removal suggests that a newer version of ws or its parent dependencies no longer explicitly require it, or its functionality has been integrated or superseded. Given it's a minor dependency update, this should not cause issues, but it's worth noting as it implies a change in the dependency tree's optimization strategy.

[alexcos20]

AI automated code review (Gemini 3).

Overall risk: low

Summary:
This pull request, generated by Dependabot, updates the ws dependency in the controlpanel subproject. Specifically, ws is updated from 6.2.2 to 6.2.3 for some nested dependencies (e.g., react-native/node_modules/ws) and from 7.5.9 to 7.5.10 for others (e.g., @walletconnect/jsonrpc-ws-connection/node_modules/ws). The update also introduces several new optional @parcel/watcher native modules for various platforms and removes utf-8-validate. These are minor patch updates, generally indicating bug fixes or small improvements.

Comments:
• [INFO][other] This PR updates ws from 6.2.2 to 6.2.3 for @react-native/dev-middleware and react-native's nested ws dependency. This is a minor patch version bump, likely containing bug fixes or minor improvements. Given its nested nature and minor increment, it's low risk.
• [INFO][other] The ws dependency is also updated from 7.5.9 to 7.5.10 for other transitive dependencies like @walletconnect/jsonrpc-ws-connection, metro, and react-devtools-core. Similar to the 6.x update, this is a minor patch and generally low risk.
• [INFO][performance] Several new @parcel/watcher native modules for various platforms (e.g., android-arm64, darwin-x64, linux-x64-glibc, win32-x64) have been added as optional dependencies. These are typically used to improve file watching performance in development environments (e.g., by bundlers like Parcel). Since they are optional and platform-specific, their addition is benign and likely beneficial for relevant build environments.
• [INFO][other] The utf-8-validate package has been removed. This package is often an optional performance dependency for ws (native C++ bindings). Its removal indicates that the updated ws versions or other related dependencies no longer pull it in directly, or a different optimization strategy is being used. As it was an optional dependency, its removal is generally safe and doesn't indicate a functional issue.