build(deps): bump ws and @nx/angular

[dependabot]

Bumps ws to 8.21.1 and updates ancestor dependency @nx/angular. These dependencies need to be updated together.

Updates ws from 8.19.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Updates @nx/angular from 21.1.2 to 23.1.0

Release notes

Sourced from @​nx/angular's releases.

23.1.0 (2026-07-13)

🚀 Features

• ⚠️ angular: support angular v22 (#35851, #35910)
• core: show a performance report at the end of every run (#36077)
• core: support filtered targetDefaults via the nested-array shape (#36049)
• core: re-add isCacheableTask helper (#36177)
• core: add mouse support to the terminal UI (#35868)
• core: scaffold create-nx-workspace into the current directory (#36134)
• expo: support Expo SDK 56 (#35904, #35714)
• ⚠️ linter: drop eslint v8 support (#36006)
• linter: add migration to drop typescript-eslint v8-removed rules from flat configs (#36123)
• misc: add next 14 to 15 and react 18 to 19 upgrade paths (#36031)
• nx-cloud: add utm tracking to clickable cloud prompt links (#36028)
• nx-dev: show product hunt launch banner in docs (#36112)
• nx-dev: show product hunt launch banner in docs" (#36129, #36112)
• release: add option to force changelog generation for programmatic usage (#36242)
• repo: enable the tsgo compiler workspace-wide (#35926, #35047, #35167)
• rspack: support @​rspack/core@​2 and @​rsbuild/core@​2 (multi-version compliance) (#35682, #35764, #13420, #781)
• storybook: update Storybook to support Angular 22 (#36293)
• testing: add migration to verify typecheck after the 23.1 migration (#36106)
• vite: add configurable ts paths build/test targets and stabilize build coordination (#34890)

🩹 Fixes

• angular: resolve esbuild option paths relative to the workspace root (#36017, #35936)
• angular: bump prescribed angular version to 22.0.4 (#36130)
• angular: make nx migrate to Angular 22 leave a buildable workspace (#36183)
• angular-rspack: surface compilation failures as build errors and release resources on teardown (#36018)
• bundling: restore preprocessor extensions in postcss normalizeOp… (#36057, #35854)
• bundling: prevent TS6059 when an app imports a workspace lib from source (#36217, #35017)
• core: avoid tsconfig path false positives for sibling project roots (#35796, #35795, #35786)
• core: do not write minimumReleaseAgeExclude during nx migrate (#36045)
• core: do not crash nx migrate on non-semver dependency specifiers (#36051)
• core: format AI-edited files after agentic migrations (#36064)
• core: prefer module.registerHooks to avoid DEP0205 deprecation warning (#36081)
• core: prevent nx migrate crash when include=optional filters out the target package (#36087)
• core: make nx migrate honor preapproved packages and emit a valid temp workspace (#36086)
• core: skip daemon project-graph recompute on no-op file rewrites (#36082)
• core: prevent the TUI from auto-selecting a completed task when a batch finishes (#35833)
• core: deregister pseudo-terminal exit handlers when tasks finish (#36115)
• core: prevent path traversal / zip-slip in self-hosted remote cache (#36116)
• core: respect explicit --nxCloud=skip for AI agents in create-nx-workspace (#36131)
• core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#36132, #36116)
• core: throw actionable error when pnpm .modules.yaml is missing (#35666, #35635)
• core: support ${configDir} in tsconfig path alias resolution (#36037, #35804)
• core: prevent non-npm devEngines pin from breaking npm registry lookups (#36020, #35815)
• core: clarify nx sync remediation messaging and surface spinner output in non-tty (#35747)
• core: exclude direct-dependency overrides from generated package.json (#36040, #35675)

... (truncated)

Commits

• a88e494 chore(repo): migrate to nx 23.1.0-rc.2 (#36269)
• f45a6a1 fix(testing): disable justInTimeCompile for webpack Cypress component testing...
• 15cfe44 fix(angular): make nx migrate to Angular 22 leave a buildable workspace (#36183)
• df5157b feat(core): support filtered targetDefaults via the nested-array shape (#36049)
• 1393537 fix(angular): bump prescribed angular version to 22.0.4 (#36130)
• f22e75c feat(repo): enable the tsgo compiler workspace-wide (#35926)
• 192f668 feat(angular): support angular v22 (#35851)
• 82d0cf1 fix(angular): resolve esbuild option paths relative to the workspace root (#3...
• a44086e feat(linter)!: drop eslint v8 support (#36006)
• 71bbc70 feat(core): revert array-shape targetDefaults support pending redesign and re...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nx/angular since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.