Core: Upgrade ws to fix security advisories

[ndelangen]

Closes storybookjs/mcp#370

What I did

Bump Storybook core's ws dependency from 8.19.0 → 8.21.1 so published storybook no longer pulls a vulnerable ws.

This clears two advisories on the storybook > ws path:

• GHSA-96hv-2xvq-fx4p (high) — memory exhaustion DoS from tiny fragments/chunks
• GHSA-58qx-3vcg-4xpx (moderate) — uninitialized memory disclosure in close()

Changes

• code/core/package.json: "ws": "^8.18.0" → "^8.21.1"
• yarn.lock: core/storybook now resolves ws@8.21.1

Reviewer notes

• Storybook only uses WebSocket / WebSocketServer from ws. The 8.21 security fix adds maxBufferedChunks / maxFragments with high defaults; no Storybook API changes required.
• yarn.lock may still contain ws@8.19.0 for unrelated dependents (e.g. webpack-dev-server, @vitest/browser). That does not affect the audited storybook > ws path this PR targets.

Checklist for Contributors

Testing

The changes in this PR are covered in the following automated tests:

• stories
• unit tests
• integration tests
• end-to-end tests

Manual testing

Caution

This section is mandatory for all contributions. If you believe no manual test is necessary, please state so explicitly. Thanks!

1. Confirm the resolved version:

   yarn why ws

   Expect storybook / code/core on ws@8.21.1.
2. Start the internal UI:

   cd code && yarn storybook:ui

3. In the browser, switch between a few stories and confirm manager ↔ preview still works (story selection, controls/args updates, no websocket/channel errors in the browser or terminal).
4. Optional regression check: edit a story source file and confirm HMR still refreshes the preview.

Documentation

• Add or update documentation reflecting your changes
• If you are deprecating/removing a feature, make sure to update
  MIGRATION.MD

Checklist for Maintainers

• When this PR is ready for testing, make sure to add ci:normal, ci:merged or ci:daily GH label to it to run a specific set of sandboxes. The particular set of sandboxes can be found in code/lib/cli-storybook/src/sandbox-templates.ts

• Declare whether manual QA will be needed for this PR during the next release, through qa:needed or qa:skip

• Make sure this PR contains one of the labels below:

  Available labels

  • bug: Internal changes that fixes incorrect behavior.
  • maintenance: User-facing maintenance tasks.
  • dependencies: Upgrading (sometimes downgrading) dependencies.
  • build: Internal-facing build tooling & test updates. Will not show up in release changelog.
  • cleanup: Minor cleanup style change. Will not show up in release changelog.
  • documentation: Documentation only changes. Will not show up in release changelog.
  • feature request: Introducing a new feature.
  • BREAKING CHANGE: Changes that break compatibility in some way with current major version.
  • other: Changes that don't fit in the above categories.

🦋 Canary release

This PR does not have a canary release associated. You can request a canary release of this pull request by mentioning the @storybookjs/core team here.

core team members can create a canary release here or locally with gh workflow run --repo storybookjs/storybook publish.yml --field pr=<PR_NUMBER>

Summary by CodeRabbit

• Chores
  • Updated the WebSocket dependency to a newer version for improved compatibility and maintenance.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7f6d7df5-1d16-4da2-a7e6-afb8d735a336

📥 Commits

Reviewing files that changed from the base of the PR and between 6b378f9 and e7b38ed.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• code/core/package.json

---

📝 Walkthrough

Walkthrough

The core package updates its ws dependency constraint from ^8.18.0 to ^8.21.1.

Changes

WebSocket dependency update

Layer / File(s)	Summary
Update ws dependency constraint code/core/package.json	Changes the ws dependency range to ^8.21.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• storybookjs/mcp#370 — Both changes update ws from ^8.18.0 to ^8.21.1 to address vulnerabilities.

---

_{Comment @coderabbitai help to get the list of available commands.}