fix(dts-plugin): update ws to 8.21.3

[ScriptedAlchemy]

Updates the direct ws dependency in @module-federation/dts-plugin from 8.21.0 to 8.21.3 and refreshes the pnpm lockfile.

This removes the vulnerable version reported in #4926 (CVE-2026-62389). A patch changeset is included so consumers receive the fix in the next release. The issue should remain open until that release is published.

Validation:

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm exec prettier --check packages/dts-plugin/package.json pnpm-lock.yaml .changeset/secure-websocket-client.md
• pnpm exec turbo run build test --filter=@module-federation/dts-plugin --force (158 tests passed)
• Changesets scope and release-plan validation passed

Skipped: repo-wide CI and unrelated E2E jobs; the change is limited to one package dependency and release metadata.

[changeset-bot]

🦋 Changeset detected

Latest commit: 0359e56

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 48 packages

Name	Type
@module-federation/dts-plugin	Patch
@module-federation/cli	Patch
@module-federation/enhanced	Patch
@module-federation/manifest	Patch
@module-federation/metro	Patch
@module-federation/rspack	Patch
@module-federation/modern-js-v3	Patch
@module-federation/modern-js	Patch
@module-federation/nextjs-mf	Patch
@module-federation/node	Patch
@module-federation/rsbuild-plugin	Patch
@module-federation/rspress-plugin	Patch
@module-federation/rstest	Patch
@module-federation/storybook-addon	Patch
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
@module-federation/metro-plugin-rnc-cli	Patch
@module-federation/metro-plugin-rnef	Patch
@module-federation/metro-plugin-rock	Patch
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
node-dynamic-remote-new-version	Patch
node-dynamic-remote	Patch
@module-federation/playground	Patch
remote5	Patch
remote6	Patch
website-new	Patch
@module-federation/runtime	Patch
@module-federation/webpack-bundler-runtime	Patch
@module-federation/sdk	Patch
@module-federation/runtime-tools	Patch
@module-federation/managers	Patch
@module-federation/third-party-dts-extractor	Patch
@module-federation/devtools	Patch
@module-federation/bridge-react	Patch
@module-federation/bridge-vue3	Patch
@module-federation/bridge-shared	Patch
@module-federation/bridge-react-webpack-plugin	Patch
@module-federation/retry-plugin	Patch
@module-federation/error-codes	Patch
@module-federation/inject-external-runtime-core-plugin	Patch
@module-federation/runtime-core	Patch
create-module-federation	Patch
@module-federation/treeshake-server	Patch
@module-federation/treeshake-frontend	Patch
@module-federation/esbuild	Patch
@module-federation/observability-plugin	Patch
@module-federation/utilities	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/devtools@0359e56

@module-federation/cli

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/cli@0359e56

create-module-federation

pnpm add https://pkg.pr.new/module-federation/core/create-module-federation@0359e56

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/dts-plugin@0359e56

@module-federation/enhanced

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/enhanced@0359e56

@module-federation/error-codes

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/error-codes@0359e56

@module-federation/esbuild

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/esbuild@0359e56

@module-federation/managers

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/managers@0359e56

@module-federation/manifest

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/manifest@0359e56

@module-federation/metro

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/metro@0359e56

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/metro-plugin-rnc-cli@0359e56

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/metro-plugin-rnef@0359e56

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/metro-plugin-rock@0359e56

@module-federation/modern-js

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/modern-js@0359e56

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/modern-js-v3@0359e56

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/native-federation-tests@0359e56

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/native-federation-typescript@0359e56

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/nextjs-mf@0359e56

@module-federation/node

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/node@0359e56

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/observability-plugin@0359e56

@module-federation/playground

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/playground@0359e56

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/retry-plugin@0359e56

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/rsbuild-plugin@0359e56

@module-federation/rspack

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/rspack@0359e56

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/rspress-plugin@0359e56

@module-federation/rstest

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/rstest@0359e56

@module-federation/runtime

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/runtime@0359e56

@module-federation/runtime-core

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/runtime-core@0359e56

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/runtime-tools@0359e56

@module-federation/sdk

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/sdk@0359e56

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/storybook-addon@0359e56

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/third-party-dts-extractor@0359e56

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/treeshake-frontend@0359e56

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/treeshake-server@0359e56

@module-federation/typescript

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/typescript@0359e56

@module-federation/utilities

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/utilities@0359e56

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/webpack-bundler-runtime@0359e56

@module-federation/bridge-react

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/bridge-react@0359e56

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/bridge-react-webpack-plugin@0359e56

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/bridge-shared@0359e56

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/bridge-vue3@0359e56

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/module-federation/core/@module-federation/inject-external-runtime-core-plugin@0359e56

commit: 0359e56

[github-actions]

Bundle Size Report

9 package(s) changed, 34 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/inject-external-runtime-core-plugin	5.2 kB	-26 B (-0.5%)	519 B	no change
@module-federation/runtime-core	295.9 kB	+8 B (+0.0%)	570 B	no change
@module-federation/runtime-tools	7.7 kB	-65 B (-0.8%)	142 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	+1 B (+0.0%)	2.4 kB	-30 B (-1.2%)
@module-federation/core	1.0 kB	-2 B (-0.2%)	1.0 kB	-31 B (-2.9%)
@module-federation/devtools	30.3 kB	-1 B (-0.0%)	30.3 kB	-23 B (-0.1%)
@module-federation/enhanced	2.7 kB	-2 B (-0.1%)	2.8 kB	-40 B (-1.4%)
@module-federation/metro-plugin-rnc-cli	416 B	-1 B (-0.2%)	435 B	-24 B (-5.2%)
@module-federation/node	9.2 kB	+2 B (+0.0%)	9.2 kB	-26 B (-0.3%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	21.6 kB	-16 B (-0.1%)	23.1 kB	-16 B (-0.1%)	+1.5 kB	0 B

Total dist (raw): 35.88 MB (-83 B (-0.0%))
Total ESM gzip: 109.3 kB (no change)
Total web bundle (gzip): 238.2 kB (-3 B (-0.0%))
Total node bundle (gzip): 240.5 kB (-174 B (-0.1%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.