Bump vulnerable dependencies: ws, express, fast-xml-parser, ajv

[wojtekn]

Fixes Dependabot alerts by bumping the minimum required versions:

Package	Dep	From	To	Fixes
@wp-playground/mcp	ws	^8.18.0	^8.21.0	#224
root	express	4.22.0	4.22.2	#228, #89, #110
root	fast-xml-parser	^5.5.1	^5.8.0	#206, #205
root	ajv	8.12.0	8.18.0	#121

ws is added to the overrides section (not dependencies) in the root package.json to force ^8.21.0 across all transitive consumers. This is necessary because @module-federation/dts-plugin and webpack-dev-server pin ws to exactly 8.18.0, which would otherwise win as the hoisted version despite @wp-playground/mcp requesting ^8.21.0.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates minimum dependency versions to address Dependabot security alerts, with a focus on ws, express, fast-xml-parser, and ajv.

Changes:

• Bumped ws in @wp-playground/mcp to ^8.21.0
• Bumped root dependencies: express to 4.22.2, fast-xml-parser to ^5.8.0, ajv to 8.18.0
• Added ws to root dependencies

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
packages/playground/mcp/package.json	Updates ws dependency range to a patched version.
package.json	Bumps vulnerable deps and adds ws at the root level.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[adamziel]

@wojtekn @mho22 this PR breaks releases of npm packages as follows:

npm 11 rejected packing @wp-playground/mcp:
Override for ws@8.21.0 conflicts with direct dependency

The description lists fixed issues, but they're not actually fixed by this PR.

Also:

This is necessary because @module-federation/dts-plugin and webpack-dev-server pin ws to exactly 8.18.0

What are other consequences of overriding this pin?

[wojtekn]

@adamziel, my bad, I messed up the Dependabot links. Those were Studio numbers:

• ws: https://github.com/Automattic/studio/security/dependabot/224
• qs via express: https://github.com/Automattic/studio/security/dependabot/228
• qs via express: https://github.com/Automattic/studio/security/dependabot/110
• ajv: https://github.com/Automattic/studio/security/dependabot/121
• fast-xml-builder via fast-xml-parser: https://github.com/Automattic/studio/security/dependabot/206
• fast-xml-builder via fast-xml-parser: https://github.com/Automattic/studio/security/dependabot/205

Thanks for fixing the issue caused by the ws override.

What are other consequences of overriding this pin?

In theory, those could cause unexpected behavior, but in practice, ws should be backwards compatible across those versions. Did you spot any issues related to that?