Bump ws to 8.20.1 to address GHSA-58qx-3vcg-4xpx by sassyconsultingllc · Pull Request #13978 · cloudflare/workers-sdk

sassyconsultingllc · 2026-05-19T22:54:47Z

Describe your change...

Bumps the workspace catalog entry for ws from 8.18.0 to 8.20.1 so that miniflare, wrangler, and @cloudflare/vite-plugin (the three workspace packages that consume ws via catalog:default) pick up the patched release for GHSA-58qx-3vcg-4xpx / CVE-2026-45736.

The vulnerability is an uninitialized-memory disclosure in WebSocket.close() when a TypedArray is passed as the reason argument. The fix shipped upstream in ws@8.20.1 (commit c0327ec) on 2026-05-12; this PR is the downstream propagation.

Diff summary

pnpm-workspace.yaml: catalog ws: 8.18.0 → 8.20.1 (one line).
pnpm-lock.yaml: regenerated via pnpm install.
.changeset/bump-ws-8-20-1.md: patch changeset for miniflare, wrangler, @cloudflare/vite-plugin.

Out of scope (separate upstreams)

The lockfile still resolves ws@8.18.0 from two transitive paths that pin it directly rather than via the catalog:

@cloudflare/puppeteer@1.0.4 declares ws@8.18.0 in its own published package.json.
An older miniflare@4.20260317.1 is pulled in via node_modules/.pnpm/... for some dev-dep path.

Both would need their own bumps in their respective repositories to fully clear the audit warning, and are outside the scope of a catalog change.

Verification

pnpm install --filter "miniflare..." produces a clean lockfile diff (only ws entries change).
pnpm run build --filter miniflare succeeds (6/6 tasks, types bundled with 0 errors / 0 warnings).
pnpm test:ci --filter miniflare: 787 tests pass; 20 failures all in test/plugins/browser/index.spec.ts (an undici JSON-parse failure in browser-rendering tests) — confirmed pre-existing on main at the same commit without this change, so unrelated to the bump.
ws@8.20.1 release notes confirm the change is security-only with no breaking changes or behavior differences.

Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because: this is a dependency-only patch bump (ws@8.18.0 → 8.20.1); the patched release's notes confirm security-fix only with no API or behavior change, and the existing miniflare test suite (787 unrelated passes) covers the WebSocket surface.
Public documentation
- Cloudflare docs PR(s):
- Documentation not necessary because: no user-facing behavior change; bump is transparent to consumers.

A picture of a cute animal (not mandatory, but encouraged)

🦊

changeset-bot · 2026-05-19T22:54:53Z

🦋 Changeset detected

Latest commit: e338bee

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
miniflare	Patch
wrangler	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/pages-shared	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

workers-devprod · 2026-05-19T22:55:13Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

Copilot

Pull request overview

This PR bumps the workspace catalog version of ws to pick up the patched 8.20.1 release for GHSA-58qx-3vcg-4xpx across workspace packages that consume ws via the catalog.

Changes:

Updates ws in pnpm-workspace.yaml from 8.18.0 to 8.20.1.
Regenerates pnpm-lock.yaml for the updated catalog dependency.
Adds a patch changeset for miniflare, wrangler, and @cloudflare/vite-plugin.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`pnpm-workspace.yaml`	Updates the catalog entry for `ws`.
`pnpm-lock.yaml`	Updates lockfile resolutions for the catalog `ws` bump.
`.changeset/bump-ws-8-20-1.md`	Adds release notes for affected packages.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

pkg-pr-new · 2026-05-20T12:30:20Z

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13978

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13978

miniflare

npm i https://pkg.pr.new/miniflare@13978

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13978

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13978

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13978

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13978

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13978

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@13978

wrangler

npm i https://pkg.pr.new/wrangler@13978

commit: e338bee

The workspace catalog pinned ws@8.18.0, which is vulnerable to an uninitialized memory disclosure when a TypedArray is passed as the reason argument to WebSocket.close() (GHSA-58qx-3vcg-4xpx / CVE-2026-45736, fixed upstream in ws@8.20.1). This bump propagates the patched release to miniflare, wrangler, and @cloudflare/vite-plugin, all of which consume `ws` via catalog:default. Two transitive consumers (@cloudflare/puppeteer@1.0.4 and an older miniflare@4.20260317.1 snapshot pulled in elsewhere in the lockfile) still pin 8.18.0 directly — those are outside the scope of a catalog bump and need their own upstream fixes.

petebacondarwin

I cleaned up the lockfile for you. LGTM - thanks

workers-devprod

Codeowners reviews satisfied

Rework the prod/staging npm-audit check to classify by advisory (GHSA) rather than by package, and add an AUDIT_EXCEPTIONS allowlist. Exempt GHSA-96hv-2xvq-fx4p (ws memory-exhaustion DoS): it reaches us only via wrangler -> miniflare, the local dev/test simulator, which never runs in production (the deployed Worker uses Cloudflare's runtime, not miniflare). miniflare pins ws@8.20.1 exactly; the fix is ws@8.21.0, awaiting an upstream bump (follow-up to cloudflare/workers-sdk#13978). Allowlisted advisories surface as a non-blocking WARN, never hidden. Any other high/critical -- including a different future ws advisory, since a new advisory carries a new id -- still fails the gate. Remove the entry once wrangler/miniflare ships the ws bump.

Copilot AI review requested due to automatic review settings May 19, 2026 22:54

sassyconsultingllc requested a review from workers-devprod as a code owner May 19, 2026 22:54

workers-devprod requested review from a team and edmundhung and removed request for a team May 19, 2026 22:55

Copilot started reviewing on behalf of sassyconsultingllc May 19, 2026 22:55 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread pnpm-lock.yaml Outdated

devin-ai-integration Bot reviewed May 19, 2026

View reviewed changes

sassyconsultingllc mentioned this pull request May 20, 2026

chore(deps): bump ws to 8.20.1 (GHSA-58qx-3vcg-4xpx) cloudflare/puppeteer#209

Open

workers-devprod added this to workers-sdk May 20, 2026

github-project-automation Bot moved this to Untriaged in workers-sdk May 20, 2026

petebacondarwin force-pushed the bump-miniflare-ws-8.20.1 branch from e5b89e0 to e338bee Compare May 20, 2026 12:44

petebacondarwin approved these changes May 20, 2026

View reviewed changes

workers-devprod approved these changes May 20, 2026

View reviewed changes

github-project-automation Bot moved this from Untriaged to Approved in workers-sdk May 20, 2026

petebacondarwin merged commit fa1f61f into cloudflare:main May 20, 2026
71 of 73 checks passed

github-project-automation Bot moved this from Approved to Done in workers-sdk May 20, 2026

workers-devprod mentioned this pull request May 20, 2026

Version Packages #13969

Merged

ascorbic mentioned this pull request May 20, 2026

Miniflare pins vulnerable ws@8.18.0, blocking Dependabot security updates #13986

Closed

penalosa pushed a commit that referenced this pull request May 28, 2026

Bump ws to 8.20.1 to address GHSA-58qx-3vcg-4xpx (#13978)

024c845

haidargit mentioned this pull request Jun 18, 2026

Bump ws to 8.21.0 to address GHSA-96hv-2xvq-fx4p #14346

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump ws to 8.20.1 to address GHSA-58qx-3vcg-4xpx#13978

Bump ws to 8.20.1 to address GHSA-58qx-3vcg-4xpx#13978
petebacondarwin merged 1 commit into
cloudflare:mainfrom
sassyconsultingllc:bump-miniflare-ws-8.20.1

sassyconsultingllc commented May 19, 2026 •

edited by devin-ai-integration Bot

Loading

Uh oh!

changeset-bot Bot commented May 19, 2026 •

edited

Loading

Uh oh!

workers-devprod commented May 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

pkg-pr-new Bot commented May 20, 2026 •

edited

Loading

Uh oh!

petebacondarwin left a comment

Uh oh!

workers-devprod left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

sassyconsultingllc commented May 19, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Diff summary

Out of scope (separate upstreams)

Verification

Uh oh!

changeset-bot Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

workers-devprod commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

pkg-pr-new Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

petebacondarwin left a comment

Choose a reason for hiding this comment

Uh oh!

workers-devprod left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sassyconsultingllc commented May 19, 2026 •

edited by devin-ai-integration Bot

Loading

changeset-bot Bot commented May 19, 2026 •

edited

Loading

workers-devprod commented May 19, 2026 •

edited

Loading

pkg-pr-new Bot commented May 20, 2026 •

edited

Loading