Skip to content

Bump ws, @wdio/browserstack-service, @wdio/cli and @wdio/local-runner - #4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4dc37c47b1
Open

Bump ws, @wdio/browserstack-service, @wdio/cli and @wdio/local-runner#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4dc37c47b1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown

Bumps ws to 8.21.0 and updates ancestor dependencies ws, @wdio/browserstack-service, @wdio/cli and @wdio/local-runner. These dependencies need to be updated together.

Updates ws from 8.16.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits
  • bca91ad [dist] 8.21.0
  • 2b2abd4 [security] Limit retained message parts
  • 78eabe2 [security] Add latest vulnerability to SECURITY.md
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • 8439255 [dist] 8.20.0
  • d3503c1 [minor] Export the PerMessageDeflate class and header utils
  • Additional commits viewable in compare view

Updates @wdio/browserstack-service from 8.50.0 to 9.34.1

Release notes

Sourced from @​wdio/browserstack-service's releases.

@​wdio/browserstack-service@​9.34.1

Patch Changes

  • b9bb4eb: - Fixed browserstack_executor commands issued through browser.execute() or browser.executeAsync() being ignored in WebDriver BiDi sessions.

@​wdio/browserstack-service@​9.34.0

Minor Changes

  • aa16aa1: - The debug logs the service uploads at the end of a run now include a copy of your wdio.conf file (and the local config files it imports) plus your package.json, with values under known credential keys removed on a best-effort basis, so BrowserStack support can investigate configuration issues without asking you to reproduce them.
    • Set disableAutoCaptureLogs: true in the service options, or BROWSERSTACK_DISABLE_AUTO_CAPTURE_LOGS=true, to turn this upload off entirely.

Patch Changes

  • 69ede2a: - Fixed inflated build durations on the Test Observability dashboard for WebdriverIO + Cucumber runs: hooks interrupted mid-run are now closed instead of staying "in progress" until the hook timeout.
  • f75b180: - Fixed WebdriverIO (Mocha) builds occasionally being reported as timed out even though the test run finished successfully.
  • 0986e13: - Fixed App Automate and Automate session names staying on the static sessionName capability instead of the test title, for suites that reload the session between tests or whose run ends before the WebdriverIO after hook.
  • 941b677: - Made the Test Reporting build-completion signal more resilient on restricted corporate networks, so builds are less likely to be left showing as "running" after a run ends.
    • Each delivery attempt is now individually time-bounded, so a hung connection can no longer stall the end of a run.
    • When the signal still cannot be delivered, the log now records the underlying network reason (for example a DNS or proxy failure) instead of a generic fetch failed.
  • 52f0cf4: - Fixed test results not appearing in Test Reporting for WebdriverIO + Mocha when the project is not a git repository.
    • Fixed the BrowserStack binary not updating once a copy was already present, which could leave a machine on an old binary indefinitely.

@​wdio/browserstack-service@​9.33.2

Patch Changes

  • b688f05: - Fixed Accessibility Automation producing no report for WebdriverIO suites running on the jasmine framework. Accessibility scans now run for jasmine specs, as they already did for mocha.

@​wdio/browserstack-service@​9.33.1

Patch Changes

  • 4b19d7a: - Fixed App Automate session names not updating to the test title when the app is provided via the appium:app capability.
  • 929b1f5: - Fixed WebdriverIO test results sometimes not appearing (builds staying "in progress") when the build-completion signal failed or the test runner was interrupted.

@​wdio/browserstack-service@​9.33.0

Minor Changes

  • e99828d: - Fixed SDK logs not being uploaded when a test run is interrupted (Ctrl-C or CI job cancellation); interrupted runs are now correctly reported with their termination reason.

Patch Changes

  • 74c2682: - Read the apis service-URL map from the binary's new config.sessionData bucket (SDK-6821 session.config split), with the flat config.apis as backward-compat fallback. Single-point change in setConfig; verified npm run build clean and the vitest suite shows zero new failures vs main (68 pre-existing environmental failures identical on both).

@​wdio/browserstack-service@​9.32.1

Patch Changes

  • aefd604: - Fixed a statically-skipped test (it.skip) being left orphaned as "in progress" on the Test Observability dashboard in the CLI flow. Such tests are reported from the un-awaited onTestSkip reporter hook, so their TestRunFinished event could still be pending when the worker tore down; the after() hook now drains these skip reports before the session closes so the test is correctly reported as skipped.
  • 1a973e9: - fix: Accessibility command wrapping.
  • a24973b: - Fixed Test Observability not being fully disabled for a run when the build could not be started (e.g. an unsupported framework) — such sessions no longer emit observability events or get linked to a non-existent build.
  • 8539e5f: fix(a11y): restore per-command auto-scanning for App Automate accessibility sessions

... (truncated)

Changelog

Sourced from @​wdio/browserstack-service's changelog.

9.34.1

Patch Changes

  • b9bb4eb: - Fixed browserstack_executor commands issued through browser.execute() or browser.executeAsync() being ignored in WebDriver BiDi sessions.

9.34.0

Minor Changes

  • aa16aa1: - The debug logs the service uploads at the end of a run now include a copy of your wdio.conf file (and the local config files it imports) plus your package.json, with values under known credential keys removed on a best-effort basis, so BrowserStack support can investigate configuration issues without asking you to reproduce them.
    • Set disableAutoCaptureLogs: true in the service options, or BROWSERSTACK_DISABLE_AUTO_CAPTURE_LOGS=true, to turn this upload off entirely.

Patch Changes

  • 69ede2a: - Fixed inflated build durations on the Test Observability dashboard for WebdriverIO + Cucumber runs: hooks interrupted mid-run are now closed instead of staying "in progress" until the hook timeout.
  • f75b180: - Fixed WebdriverIO (Mocha) builds occasionally being reported as timed out even though the test run finished successfully.
  • 0986e13: - Fixed App Automate and Automate session names staying on the static sessionName capability instead of the test title, for suites that reload the session between tests or whose run ends before the WebdriverIO after hook.
  • 941b677: - Made the Test Reporting build-completion signal more resilient on restricted corporate networks, so builds are less likely to be left showing as "running" after a run ends.
    • Each delivery attempt is now individually time-bounded, so a hung connection can no longer stall the end of a run.
    • When the signal still cannot be delivered, the log now records the underlying network reason (for example a DNS or proxy failure) instead of a generic fetch failed.
  • 52f0cf4: - Fixed test results not appearing in Test Reporting for WebdriverIO + Mocha when the project is not a git repository.
    • Fixed the BrowserStack binary not updating once a copy was already present, which could leave a machine on an old binary indefinitely.

9.33.2

Patch Changes

  • b688f05: - Fixed Accessibility Automation producing no report for WebdriverIO suites running on the jasmine framework. Accessibility scans now run for jasmine specs, as they already did for mocha.

9.33.1

Patch Changes

  • 4b19d7a: - Fixed App Automate session names not updating to the test title when the app is provided via the appium:app capability.
  • 929b1f5: - Fixed WebdriverIO test results sometimes not appearing (builds staying "in progress") when the build-completion signal failed or the test runner was interrupted.

9.33.0

Minor Changes

  • e99828d: - Fixed SDK logs not being uploaded when a test run is interrupted (Ctrl-C or CI job cancellation); interrupted runs are now correctly reported with their termination reason.

Patch Changes

  • 74c2682: - Read the apis service-URL map from the binary's new config.sessionData bucket (SDK-6821 session.config split), with the flat config.apis as backward-compat fallback. Single-point change in setConfig; verified npm run build clean and the vitest suite shows zero new failures vs main (68 pre-existing environmental failures identical on both).

9.32.1

Patch Changes

... (truncated)

Commits
  • de9518d Version Packages
  • dc7fe43 Merge branch 'main' into bidi-browserstack-executor-http
  • b6f1f18 fix(browserstack-service): route executeAsync executor payloads over HTTP on ...
  • d9c585c fix(browserstack-service): gate BiDi executor routing on BrowserStack sessions
  • c1ebb00 fix(browserstack-service): tolerate leading whitespace in BiDi executor routing
  • da8f719 Version Packages
  • d4878ad Merge pull request #148 from browserstack/fix/sdk-7270-session-name-per-test
  • ba6a493 Merge pull request #147 from browserstack/feat/sdk-7250-capture-wdio-conf
  • fb9a578 Merge pull request #145 from browserstack/fix/sdk-7233-wdio-test-file-path-an...
  • 3eeb3e5 Merge pull request #143 from browserstack/fix/sdk-7229-buildstop-resilience
  • Additional commits viewable in compare view

Updates @wdio/cli from 8.46.0 to 9.31.1

Release notes

Sourced from @​wdio/cli's releases.

v9.31.1

No updates!

v9.31.0

⚠️ Partially failed release. Please use v9.31.1 instead.

v9.31.0 (2026-08-18)

🚀 New Feature

  • eslint-plugin-wdio, wdio-browser-runner, wdio-globals, wdio-jasmine-framework, wdio-local-runner, wdio-runner

🐛 Bug Fix

📝 Documentation

🏠 Internal

Committers: 13

... (truncated)

Changelog

Sourced from @​wdio/cli's changelog.

Changelog

Tags:

  • 💥 [Breaking Change]
  • 👓 [Spec Compliancy]
  • 🚀 [New Feature]
  • 🐛 [Bug Fix]
  • 📝 [Documentation]
  • 🏠 [Internal]
  • 💅 [Polish]

Note: Gaps between patch versions are faulty, broken or test releases.

See CHANGELOG - v4.

See CHANGELOG - v5.

See CHANGELOG - v6

See CHANGELOG - v7

See CHANGELOG - v8

v9.31.0 (2026-08-18)

🚀 New Feature

  • eslint-plugin-wdio, wdio-browser-runner, wdio-globals, wdio-jasmine-framework, wdio-local-runner, wdio-runner

🐛 Bug Fix

  • wdio-utils
  • wdio-utils, webdriver
  • webdriver
    • #15504 fix(webdriver): retry requests aborted by connectionRetryTimeout (@​birtles)
  • wdio-cli
  • wdio-browser-runner, webdriverio
  • webdriverio
    • #15477 fix(webdriverio): reset current context when browsing context is destroyed (@​Badisi)
    • #15473 fix(webdriverio): scroll by deltaX/deltaY in scrollIntoView wheel action (@​wswebcreation)
    • #15350 fix(webdriverio): guard ShadowRootManager preload script against partial-Bidi remotes (@​navin772)
  • wdio-utils, webdriverio
  • wdio-allure-reporter
    • #15502 fix(allure-reporter): don't collapse Windows paths to drive letter in toPackageLabel (@​mccmrunal)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​wdio/cli since your current version.


Updates @wdio/local-runner from 8.46.0 to 9.31.1

Release notes

Sourced from @​wdio/local-runner's releases.

v9.31.1

No updates!

v9.31.0

⚠️ Partially failed release. Please use v9.31.1 instead.

v9.31.0 (2026-08-18)

🚀 New Feature

  • eslint-plugin-wdio, wdio-browser-runner, wdio-globals, wdio-jasmine-framework, wdio-local-runner, wdio-runner

🐛 Bug Fix

📝 Documentation

🏠 Internal

Committers: 13

... (truncated)

Changelog

Sourced from @​wdio/local-runner's changelog.

Changelog

Tags:

  • 💥 [Breaking Change]
  • 👓 [Spec Compliancy]
  • 🚀 [New Feature]
  • 🐛 [Bug Fix]
  • 📝 [Documentation]
  • 🏠 [Internal]
  • 💅 [Polish]

Note: Gaps between patch versions are faulty, broken or test releases.

See CHANGELOG - v4.

See CHANGELOG - v5.

See CHANGELOG - v6

See CHANGELOG - v7

See CHANGELOG - v8

v9.31.0 (2026-08-18)

🚀 New Feature

  • eslint-plugin-wdio, wdio-browser-runner, wdio-globals, wdio-jasmine-framework, wdio-local-runner, wdio-runner

🐛 Bug Fix

  • wdio-utils
  • wdio-utils, webdriver
  • webdriver
    • #15504 fix(webdriver): retry requests aborted by connectionRetryTimeout (@​birtles)
  • wdio-cli
  • wdio-browser-runner, webdriverio
  • webdriverio
    • #15477 fix(webdriverio): reset current context when browsing context is destroyed (@​Badisi)
    • #15473 fix(webdriverio): scroll by deltaX/deltaY in scrollIntoView wheel action (@​wswebcreation)
    • #15350 fix(webdriverio): guard ShadowRootManager preload script against partial-Bidi remotes (@​navin772)
  • wdio-utils, webdriverio
  • wdio-allure-reporter
    • #15502 fix(allure-reporter): don't collapse Windows paths to drive letter in toPackageLabel (@​mccmrunal)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​wdio/local-runner since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump ws, @wdio/browserstack-service, @wdio/cli and @wdio/local-runner
06f7ed2 
Bumps [ws](https://github.com/websockets/ws) to 8.21.0 and updates ancestor dependencies [ws](https://github.com/websockets/ws), [@wdio/browserstack-service](https://github.com/browserstack/wdio-browserstack-service/tree/HEAD/packages/browserstack-service), [@wdio/cli](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-cli) and [@wdio/local-runner](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-local-runner). These dependencies need to be updated together.


Updates `ws` from 8.16.0 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.16.0...8.21.0)

Updates `@wdio/browserstack-service` from 8.50.0 to 9.34.1
- [Release notes](https://github.com/browserstack/wdio-browserstack-service/releases)
- [Changelog](https://github.com/browserstack/wdio-browserstack-service/blob/main/packages/browserstack-service/CHANGELOG.md)
- [Commits](https://github.com/browserstack/wdio-browserstack-service/commits/@wdio/browserstack-service@9.34.1/packages/browserstack-service)

Updates `@wdio/cli` from 8.46.0 to 9.31.1
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.31.1/packages/wdio-cli)

Updates `@wdio/local-runner` from 8.46.0 to 9.31.1
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.31.1/packages/wdio-local-runner)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
- dependency-name: "@wdio/browserstack-service"
  dependency-version: 9.34.1
  dependency-type: direct:development
- dependency-name: "@wdio/cli"
  dependency-version: 9.31.1
  dependency-type: direct:development
- dependency-name: "@wdio/local-runner"
  dependency-version: 9.31.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 19, 2026
@CLAassistant

CLAassistant commented Aug 19, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@CLAassistant