chore(deps): bump ws to 8.22.0, drop GHSA-96hv-2xvq-fx4p from osv-scanner.toml

[github-actions]

Summary

• Bumped ws from 8.18.3 to 8.22.0 to resolve GHSA-96hv-2xvq-fx4p (ws server-side memory exhaustion DoS)
• Removed GHSA-96hv-2xvq-fx4p exclusion from osv-scanner.toml as it is now fixed
• Updated all ws resolution entries to use the patched version

Test plan

• OSV scanner no longer flags GHSA-96hv-2xvq-fx4p vulnerability
• yarn check-deps passes successfully
• No breaking changes introduced (ws 8.22.0 is compatible)
• All ws instances across monorepo now use patched version

OSV Scanner Results

The audit now passes for GHSA-96hv-2xvq-fx4p. Previous scan showed:

| https://osv.dev/GHSA-96hv-2xvq-fx4p | 7.5  | npm       | ws                            | 5.2.4    | yarn.lock |
| https://osv.dev/GHSA-96hv-2xvq-fx4p | 7.5  | npm       | ws                            | 7.5.10   | yarn.lock |
| https://osv.dev/GHSA-96hv-2xvq-fx4p | 7.5  | npm       | ws                            | 8.17.1   | yarn.lock |

Current scan shows no GHSA-96hv-2xvq-fx4p entries (vulnerability resolved).

Still blocked exclusions

Other exclusions remain due to:

• tar 6.2.1: Required for lerna v9 compatibility (tar 7.x breaks lerna packDirectory)
• minimatch: Version 10.x breaks lerna v9 API
• sjcl: No upstream fix available (first_patched_version: null)
• form-data: Requires investigation of newer versions
• extract-zip, braces, http-cache-semantics, node-forge: No upstream fixes available

🤖 Generated with Claude Code