From 938dbfa7020003df767cdfeac2415357be950d44 Mon Sep 17 00:00:00 2001
From: szdziedzic <szymon@expo.dev>
Date: Mon, 6 Jul 2026 19:01:59 +0200
Subject: [PATCH 1/2] fix ws dependabot alert

---
 packages/worker/package.json |  2 +-
 yarn.lock                    | 31 ++++++++-----------------------
 2 files changed, 9 insertions(+), 24 deletions(-)

diff --git a/packages/worker/package.json b/packages/worker/package.json
index 124424d545..434280134d 100644
--- a/packages/worker/package.json
+++ b/packages/worker/package.json
@@ -48,7 +48,7 @@
     "tar": "7.5.7",
     "uuid": "3.4.0",
     "uuidv7": "1.1.0",
-    "ws": "8.18.0",
+    "ws": "8.21.0",
     "xml2js": "0.6.2",
     "zod": "4.1.8"
   },
diff --git a/yarn.lock b/yarn.lock
index 1324fbf043..a4f8775dd9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3607,7 +3607,7 @@ __metadata:
     typescript: "npm:5.5.4"
     uuid: "npm:3.4.0"
     uuidv7: "npm:1.1.0"
-    ws: "npm:8.18.0"
+    ws: "npm:8.21.0"
     xml2js: "npm:0.6.2"
     zod: "npm:4.1.8"
   languageName: unknown
@@ -21304,9 +21304,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ws@npm:8.18.0":
-  version: 8.18.0
-  resolution: "ws@npm:8.18.0"
+"ws@npm:8.21.0, ws@npm:^8.12.0, ws@npm:^8.13.0, ws@npm:^8.15.0":
+  version: 8.21.0
+  resolution: "ws@npm:8.21.0"
   peerDependencies:
     bufferutil: ^4.0.1
     utf-8-validate: ">=5.0.2"
@@ -21315,31 +21315,16 @@ __metadata:
       optional: true
     utf-8-validate:
       optional: true
-  checksum: 10c0/25eb33aff17edcb90721ed6b0eb250976328533ad3cd1a28a274bd263682e7296a6591ff1436d6cbc50fa67463158b062f9d1122013b361cec99a05f84680e06
+  checksum: 10c0/ef4a243476283fc49bc7550966c4af4aa0eef56273837211e700de3b664e08604a760cdddcb5ba43c049140e74ccfec5b0ee0bb439e08c2adf9138902fdde5f9
   languageName: node
   linkType: hard
 
 "ws@npm:^5.2.0":
-  version: 5.2.4
-  resolution: "ws@npm:5.2.4"
+  version: 5.2.5
+  resolution: "ws@npm:5.2.5"
   dependencies:
     async-limiter: "npm:~1.0.0"
-  checksum: 10c0/14e84e4209f86ab68b01b9ebf42c88f81f26a64ff4886ef65d27c734c9b90b8d7e84712da3c3f7a922a4ab58bf0b96544d32ae28ebbd620fcda3027dd5bc7604
-  languageName: node
-  linkType: hard
-
-"ws@npm:^8.12.0, ws@npm:^8.13.0, ws@npm:^8.15.0":
-  version: 8.17.1
-  resolution: "ws@npm:8.17.1"
-  peerDependencies:
-    bufferutil: ^4.0.1
-    utf-8-validate: ">=5.0.2"
-  peerDependenciesMeta:
-    bufferutil:
-      optional: true
-    utf-8-validate:
-      optional: true
-  checksum: 10c0/f4a49064afae4500be772abdc2211c8518f39e1c959640457dcee15d4488628620625c783902a52af2dd02f68558da2868fd06e6fd0e67ebcd09e6881b1b5bfe
+  checksum: 10c0/829b2e57028c65765a01bd240fb05c736050cc1e6836f5d6df04ebc4e78c2950c7d437bbfd01a79345050813e9da2162171be8c5b5301cc4307804932908d9de
   languageName: node
   linkType: hard
 

From 12ea548bed2d3cd096b4af6e0e3d8cad76480241 Mon Sep 17 00:00:00 2001
From: szdziedzic <szymon@expo.dev>
Date: Mon, 6 Jul 2026 19:03:00 +0200
Subject: [PATCH 2/2] add changelog for ws security fix

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd94fe7868..5d7a7f3370 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🧹 Chores
 
+- [worker] Bump `ws` to patched releases to resolve [Dependabot alert 462](https://github.com/expo/eas-cli/security/dependabot/462). ([#3963](https://github.com/expo/eas-cli/pull/3963) by [@szdziedzic](https://github.com/szdziedzic))
+
 ## [20.5.1](https://github.com/expo/eas-cli/releases/tag/v20.5.1) - 2026-07-01
 
 ### 🐛 Bug fixes