Upgrade ws package to 8.x (CVE-2024-37890)

[nthmost-orkes]

Security Issue

The ws package version 7.5.8 has a Denial of Service vulnerability (CVE-2024-37890).

Current State

• Current version: [email protected]
• Target version: [email protected] (latest stable)
• File: ui/package.json, ui/yarn.lock

Vulnerability Details

CVE-2024-37890 - DoS vulnerability when the number of received headers exceeds the server.maxHeadersCount threshold.

Fixed in [email protected] and backported to [email protected]. We should upgrade to the latest 8.x for long-term support.

Required Changes

1. Update ui/package.json to use [email protected]
2. Run yarn install to update yarn.lock
3. Test UI build and Cypress tests

Related

Part of #640 Closes #188