fix(security): pin ws to >=8.20.2 (DoS/memory disclosure)

[birme]

Summary

• Pinned transitive ws (pulled by happy-dom, dev-only) from 8.19.0 → 8.21.3 via an overrides entry ("ws": "^8.20.2") in package.json, keeping it within the 8.x major the tooling expects.
• Fixes GHSA-96hv-2xvq-fx4p (memory-exhaustion DoS from tiny fragments) and GHSA-58qx-3vcg-4xpx (uninitialized memory disclosure). ws is not used in production — the frontend uses the native browser WebSocket.

Test plan

• Tests pass (npm test) — 147 tests / 18 files
• TypeScript compiles (npm run typecheck)
• Lint clean (npm run lint)
• npm ls ws shows only >=8.20.2 (8.21.3, overridden)

Closes #649

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

[birme]

code-reviewer (daily-backlog-pr Phase 3):

Code Review

Verdict: LGTM

Summary: A correctly-executed security pin of the dev-only transitive dependency ws. The overrides mechanism is used properly and is faithfully reflected in the lockfile; no functional or architectural concerns.

---

Blocking

None.

---

Warnings

None.

---

Suggestions

• package.json:28 — The override uses ^8.20.2 (caret), which is correct: it satisfies the issue's >=8.20.2 requirement, stays within the 8.x major that happy-dom/tooling expects, and resolves to 8.21.3. Both patched advisories (GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx) are covered. No change needed — noting for the record. Optional: a one-line comment near the override referencing #649 would help future readers understand why the pin exists.

---

Verification performed

• Pin mechanism: overrides (not resolutions, which is a yarn concept) is the correct npm-native way to force a transitive version. Good npm-migration hygiene — no resolutions, no yarn artifacts.
• Lockfile reflects the pin: node_modules/ws bumped 8.19.0 -> 8.21.3 with matching resolved/integrity, satisfying ^8.20.2. Entry retains "dev": true, confirming ws is dev-only (via happy-dom); the frontend uses the native browser WebSocket, so there is no production impact.
• No nested duplicates: the changeset touches only the single top-level node_modules/ws entry; no node_modules/*/node_modules/ws nested copy is introduced, so the npm dual-resolution hazard does not apply here.

LGTM — ready to merge.

[birme]

Code Review

Verdict: LGTM

Summary: Clean, minimal dependency-security pin. The transitive ws (dev-only, pulled by happy-dom) is correctly overridden via package.json overrides, the lockfile resolves to a single deduplicated 8.21.3 that satisfies the pin, and both cited advisories are covered. No npm-migration regressions.

---

Blocking

None.

---

Warnings

None.

---

Suggestions

• package.json:28-30 — The override "ws": "^8.20.2" is slightly more conservative than the minimum fix for the cited advisories (GHSA-96hv-2xvq-fx4p fixed in 8.17.1; GHSA-58qx-3vcg-4xpx fixed well before that). ^8.20.2 is fine and safe; just noting the floor exceeds the strict advisory minimum, which is a reasonable choice.
• package-lock.json:8498-8508 — The updated node_modules/ws entry gains a "license": "MIT" field that was absent on the old 8.19.0 entry. This is benign npm lockfile normalization, no action needed.

---

Verification performed

• Override mechanism: overrides: { "ws": "^8.20.2" } is the correct npm (not yarn) way to force a transitive dep. ws is only reached via happy-dom (ws: ^8.18.3, devDependency).
• Lockfile consistency: single top-level node_modules/ws at 8.21.3; no nested node_modules/*/node_modules/ws duplicates (dedupe hazard checked). 8.21.3 satisfies ^8.20.2.
• Advisory coverage: 8.21.3 >= fix versions for both GHSA-96hv-2xvq-fx4p and GHSA-58qx-3vcg-4xpx.
• npm hygiene: lockfileVersion 3, no yarn.lock, no yarn commands introduced in scripts.

No Blocking or Warning items — safe to merge.

[birme]

Code Review

Verdict: LGTM

Summary: Pins dev-only transitive ws via overrides to 8.21.3 (DoS patch). Shares a top-level overrides block with #687 — reconcile on merge.

Reviewed against the Open Intercom code-reviewer rubric (TypeScript correctness, error handling, architecture, testing, security, WebRTC/SDP, npm-migration hygiene). No Blocking items; CI green. Approving and squash-merging via daily-backlog-pr Phase 3.