[Security upgrade] bump socket.io-client fork to ws@^8.21.0 (#35060)

* bump socket.io-client to overleaf fork 0.9.17-overleaf-6

Fixes GHSA-96hv-2xvq-fx4p (ws memory exhaustion DoS) by bumping the
overleaf/socket.io-client fork to a version that declares ws@^8.21.0
instead of ws@^1.1.5. The existing ws@npm:^8 resolution pins it to
8.21.0, removing ws@1.1.5 from yarn.lock entirely.

Depends on overleaf/socket.io-client#6.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* use 0.9.17-overleaf-6 tag for socket.io-client

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* use the socket.io-client-0.9.17-overleaf-6 release

* provide ws module for real-time acceptance tests

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 2d9a42f90bcf95a3a8f053df4c0092c4fbc26422

services/real-time/package.json

@@ -34,7 +34,7 @@
     "lodash": "^4.18.1",
     "proxy-addr": "^2.0.7",
     "socket.io": "github:overleaf/socket.io#0.9.19-overleaf-12",
-    "socket.io-client": "github:overleaf/socket.io-client#0.9.17-overleaf-5",
+    "socket.io-client": "https://github.com/overleaf/socket.io-client/archive/refs/tags/0.9.17-overleaf-6.tar.gz",
     "zod-validation-error": "^4.0.1"
   },
   "devDependencies": {
@@ -49,6 +49,7 @@
     "timekeeper": "0.0.4",
     "typescript": "^5.0.4",
     "uid-safe": "^2.1.5",
-    "vitest": "4.1.5"
+    "vitest": "4.1.5",
+    "ws": "^8.21.0"
   }
 }

yarn.lock

@@ -7208,11 +7208,12 @@ __metadata:
     sinon: "npm:^9.2.4"
     sinon-chai: "npm:3.7.0"
     socket.io: "github:overleaf/socket.io#0.9.19-overleaf-12"
-    socket.io-client: "github:overleaf/socket.io-client#0.9.17-overleaf-5"
+    socket.io-client: "https://github.com/overleaf/socket.io-client/archive/refs/tags/0.9.17-overleaf-6.tar.gz"
     timekeeper: "npm:0.0.4"
     typescript: "npm:^5.0.4"
     uid-safe: "npm:^2.1.5"
     vitest: "npm:4.1.5"
+    ws: "npm:^8.21.0"
     zod-validation-error: "npm:^4.0.1"
   languageName: unknown
   linkType: soft
@@ -26135,13 +26136,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"options@npm:>=0.0.5":
-  version: 0.0.6
-  resolution: "options@npm:0.0.6"
-  checksum: 10c0/864945aabe0e132f1fc2b290d1615f6022d48fd789580f91adf8a2a31d36b7c0f93b09c28d2c7b2dc3057e7c7fc7d608cbbe8e9b1b3f5b332d1a023afaca4f04
-  languageName: node
-  linkType: hard
-
 "ospath@npm:^1.2.2":
   version: 1.2.2
   resolution: "ospath@npm:1.2.2"
@@ -31112,13 +31106,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"socket.io-client@github:overleaf/socket.io-client#0.9.17-overleaf-5":
-  version: 0.9.17-overleaf-5
-  resolution: "socket.io-client@https://github.com/overleaf/socket.io-client.git#commit=805a73d2a2e2408982597d5986a401088b7aa588"
-  dependencies:
-    ws: "npm:^1.1.5"
-    xmlhttprequest: "npm:^1.8.0"
-  checksum: 10c0/e8d4572d253ddf107e0d9bfc0a0283ee41b39122bc28b406f89160cf9d1f746ec34e7a50ea170f0ef626d93849f612c21e08edcff0ec1f93aaea922bd04e0f61
+"socket.io-client@https://github.com/overleaf/socket.io-client/archive/refs/tags/0.9.17-overleaf-6.tar.gz":
+  version: 0.9.17-overleaf-6
+  resolution: "socket.io-client@https://github.com/overleaf/socket.io-client/archive/refs/tags/0.9.17-overleaf-6.tar.gz"
+  checksum: 10c0/d2178a6922872c4aac7987be9ba7036eb1911ff6a0a156dd274b49fc2a3f52c0b812b9f1a485bb69b74ce492a4ab636dc2e458517df39c2f818a8b29b79f88fa
   languageName: node
   linkType: hard
 
@@ -33412,13 +33403,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ultron@npm:1.0.x":
-  version: 1.0.2
-  resolution: "ultron@npm:1.0.2"
-  checksum: 10c0/67a4d8c8f2fd52879de20ba38af29ced455457f454e33dcf47cd2ded01f16d5004ffa4fed3690ade63b6581ee5d8dc65a14566385e8d1fa682b65a0bdb681b6e
-  languageName: node
-  linkType: hard
-
 "umzug@npm:^2.3.0":
   version: 2.3.0
   resolution: "umzug@npm:2.3.0"
@@ -34935,17 +34919,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ws@npm:^1.1.5":
-  version: 1.1.5
-  resolution: "ws@npm:1.1.5"
-  dependencies:
-    options: "npm:>=0.0.5"
-    ultron: "npm:1.0.x"
-  checksum: 10c0/6d4fba17187cded3d12f3ca5c0dec54f83ad4b6320b1e42dbd2ebea869208552e284276f65c7f4c3f2a0789aeb72ff34fb360e6a796bf3c316603bffcc5e287b
-  languageName: node
-  linkType: hard
-
-"ws@npm:^8.18.0, ws@npm:^8.18.3, ws@npm:^8.5.0":
+"ws@npm:^8.18.0, ws@npm:^8.18.3, ws@npm:^8.21.0, ws@npm:^8.5.0":
   version: 8.21.0
   resolution: "ws@npm:8.21.0"
   peerDependencies:
@@ -35071,13 +35045,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"xmlhttprequest@npm:^1.8.0":
-  version: 1.8.0
-  resolution: "xmlhttprequest@npm:1.8.0"
-  checksum: 10c0/c890661562e4cb6c36a126071e956047164296f58b0058ab28a9c9f1c3b46a65bf421a242d3449363a2aadc3d9769146160b10a501710d476a17d77d41a5c99e
-  languageName: node
-  linkType: hard
-
 "xpath@npm:0.0.32":
   version: 0.0.32
   resolution: "xpath@npm:0.0.32"