chore(deps): bump ip-address, ws, grpc-js

[yasnagat]

Proposed changes (including videos or screenshots)

This PR updates ws, ip-address, and @grpc-grpc-js to address related CVEs.

Issue(s)

https://rocketchat.atlassian.net/browse/SB-998

Steps to test or reproduce

Further comments

Summary by CodeRabbit

• Chores
  • Updated WebSocket library to v8.21.0 across multiple packages for improved stability.
  • Pinned SOCKS-related dependencies to ^2.8.9 to standardize networking behavior.
  • Locked OpenTelemetry gRPC exporter dependencies to @grpc/grpc-js ^1.14.4 for consistent telemetry.
  • Aligned devDependency versions to match the updated resolutions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4add1dbf-6b9e-416b-9d58-a34b99d86d06

📥 Commits

Reviewing files that changed from the base of the PR and between 9a64ba7 and e2ae51f.

📒 Files selected for processing (1)

• package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: 📦 Build Packages
• GitHub Check: CodeQL-Build

---

Walkthrough

Update ws dependency from ~8.19.0 to ~8.21.0 in three package.json files and add root Yarn resolutions to pin socks and align ws and OpenTelemetry OTLP gRPC exporter transitive dependencies.

Changes

Dependency version updates

Layer / File(s)	Summary
Root package resolutions for ws, socks, and OpenTelemetry package.json	Yarn resolutions updated: added socks-proxy-agent/socks and mongodb/socks -> ^2.8.9; consolidated ws range keys to ^8.20.1; pinned @opentelemetry/* OTLP gRPC exporter packages to use @grpc/grpc-js ^1.14.4.
Package-level ws dependency bumps apps/meteor/ee/server/services/package.json, ee/apps/ddp-streamer/package.json, packages/ddp-client/package.json	Bumped ws from ~8.19.0 to ~8.21.0 in three package.json files.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

type: chore

Suggested reviewers

• julio-rocketchat
• tassoevan

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately summarizes the main changes: bumping versions of ws, @grpc/grpc-js, and related dependencies across multiple package.json files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 096f640

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[changeset-bot]

⚠️ No Changeset found

Latest commit: 83208c3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.14%. Comparing base (a8a8087) to head (e2ae51f).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #40914      +/-   ##
===========================================
- Coverage    70.16%   70.14%   -0.02%     
===========================================
  Files         3355     3355              
  Lines       129196   129196              
  Branches     22375    22401      +26     
===========================================
- Hits         90644    90622      -22     
- Misses       35270    35276       +6     
- Partials      3282     3298      +16     

Flag	Coverage Δ
e2e	59.20% <ø> (-0.13%)	⬇️
e2e-api	46.16% <ø> (-0.06%)	⬇️
unit	70.13% <ø> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 92: The package.json currently allows floating updates for the socks
dependency ("socks": "^2.8.9"), so verify the package lifecycle scripts and
supply-chain risk and either pin to the exact vetted release ("socks": "2.8.9")
or otherwise lock the dependency range; specifically inspect the socks package
metadata and any install scripts (the "socks" package entry) and replace the
caret range with an exact version or a pinned range after confirming no
problematic lifecycle scripts or upstream advisories.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 76801332-5c15-4a40-8b6e-610cc43670c2

📥 Commits

Reviewing files that changed from the base of the PR and between a6bebd2 and 9a64ba7.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (4)

• apps/meteor/ee/server/services/package.json
• ee/apps/ddp-streamer/package.json
• package.json
• packages/ddp-client/package.json

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: cubic · AI code reviewer
• GitHub Check: Hacktron Security Check

🔇 Additional comments (5)

ee/apps/ddp-streamer/package.json (1)

49-49: Duplicate: ws version verification covered in apps/meteor/ee/server/services/package.json.

This ws version update is part of the same dependency bump. The version verification and security check are covered in the comment on apps/meteor/ee/server/services/package.json line 47.

packages/ddp-client/package.json (1)

33-33: Duplicate: ws version verification covered in apps/meteor/ee/server/services/package.json.

This ws devDependency update is part of the same dependency bump. The version verification and security check are covered in the comment on apps/meteor/ee/server/services/package.json line 47.

package.json (2)

163-166: Verify @grpc/grpc-js ^1.14.4 compatibility with OpenTelemetry OTLP gRPC exporters (package.json lines 163-166)

• npm registry contains @grpc/grpc-js@1.14.4 ✅
• Security advisories: the GitHub GraphQL query fails with 401 Requires authentication, so this can’t be assessed from the current check ❌
• Compatibility: peer-dependency metadata from .../latest for the mentioned @opentelemetry/* packages didn’t report a required @grpc/grpc-js version, so compatibility still needs to be validated against the exact OpenTelemetry exporter versions used in this repo (package.json/lockfile), not just latest.

---

94-96: ws “mismatch” doesn’t exist in practice: yarn.lock resolves ws to 8.21.0

Root resolutions pin ws to ^8.20.1, which still allows 8.21.0 (so it overlaps with the packages’ ~8.21.0). The existing yarn.lock contains an entry like "ws@npm:^8.20.1, ws@npm:~8.21.0": ... resolution: "ws@npm:8.21.0", so the resolved version matches the ~8.21.0 package declarations.

			> Likely an incorrect or invalid review comment.

apps/meteor/ee/server/services/package.json (1)

47-47: ws@8.21.0: present on npm; vulnerability check couldn’t be completed (401)

The below code does not show removed or replaced code.

		"ws": "~8.21.0"

• npm registry contains ws@8.21.0 (and ws@8.20.1).
• The security advisory query (gh api graphql ... securityVulnerabilities) returned 401 Requires authentication, so known-vulnerability status for ws@8.21.0 wasn’t established.
• The “conflicts with root resolution” note (root package.json lines 94-96) wasn’t evaluated in the provided checks; confirm the effective resolved version from yarn.lock.

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}

[julio-rocketchat]

/backport 8.5.1

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.5.1-40914
git cherry-pick c8d5e8736165d3be200b7024501468a5f5e19a75
// solve the conflict
git push

after that just run /backport 8.5.1 again

[julio-rocketchat]

/backport 8.5.1

[dionisio-bot]

Pull request #40933 added to Project: "Patch 8.5.1"