Switch to ws from websocket for determining polkadot genesis hash, update common dependencies (#2931)

* Switch to ws from websocket for determining polkadot genesis hash, update common dependencies

* Update changelog

Author: stwiname

packages/cli/CHANGELOG.md

@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- Swap `websocket` for `ws` dependency to fix CVEs (#2931)
 
 ## [6.4.1] - 2025-09-26
 ### Added

packages/cli/package.json

@@ -44,7 +44,7 @@
     "update-notifier": "^5.1.0",
     "webpack": "^5.101.3",
     "webpack-merge": "^6.0.1",
-    "websocket": "^1.0.35",
+    "ws": "^8.18.0",
     "yaml": "^2.8.1",
     "zod": "^3.25.67"
   },
@@ -56,21 +56,22 @@
     "@graphql-codegen/typescript": "^4.1.6",
     "@graphql-codegen/typescript-document-nodes": "^4.0.16",
     "@graphql-codegen/typescript-operations": "^4.6.1",
-    "@subql/common-algorand": "^4.3.1",
+    "@subql/common-algorand": "^4.4.3",
     "@subql/common-concordium": "^4.0.1",
-    "@subql/common-cosmos": "^5.2.0",
-    "@subql/common-ethereum": "^4.9.0",
-    "@subql/common-near": "^4.2.1",
-    "@subql/common-solana": "^0.0.0-2",
-    "@subql/common-stellar": "^4.2.2",
+    "@subql/common-cosmos": "^5.5.0",
+    "@subql/common-ethereum": "^4.9.3",
+    "@subql/common-near": "^4.3.4",
+    "@subql/common-solana": "^1.2.0",
+    "@subql/common-starknet": "^1.3.0",
+    "@subql/common-stellar": "^4.5.0",
     "@subql/common-substrate": "workspace:~",
     "@types/ejs": "^3.1.5",
     "@types/express": "^4.17.21",
     "@types/node": "^18.19.42",
     "@types/qrcode-terminal": "^0.12.2",
     "@types/semver": "^7.5.8",
     "@types/update-notifier": "^6",
-    "@types/websocket": "^1",
+    "@types/ws": "^8.5.13",
     "eslint": "^8.8.0",
     "eslint-config-oclif": "^4.0.0",
     "eslint-config-oclif-typescript": "^1.0.3",

packages/cli/src/jsonrpc/client/ws.ts

@@ -1,7 +1,7 @@
 // Copyright 2020-2025 SubQuery Pte Ltd authors & contributors
 // SPDX-License-Identifier: GPL-3.0
 
-import {ICloseEvent, IMessageEvent, w3cwebsocket as WebSocket} from 'websocket';
+import WebSocket from 'ws';
 import {Request, ResponseSuccessType} from './types';
 
 let id = 0;
@@ -30,11 +30,11 @@ export class WsJsonRpcClient {
       this._ws = new WebSocket(this.address);
 
       this.isReady = new Promise((resolve) => {
-        this._ws.onopen = () => resolve(this);
+        this._ws.on('open', () => resolve(this));
       });
 
-      this._ws.onclose = this.onSocketClose;
-      this._ws.onmessage = this.onSocketMessage;
+      this._ws.on('close', this.onSocketClose);
+      this._ws.on('message', this.onSocketMessage);
     } catch (error) {
       console.error(error);
     }
@@ -54,18 +54,18 @@ export class WsJsonRpcClient {
     this._ws.close();
   }
 
-  private onSocketClose = (event: ICloseEvent): void => {
+  private onSocketClose = (code: number, reason: Buffer): void => {
     if (this.isDestroyed) return;
 
-    console.error(`disconnected from ${this.address} code: '${event.code}' reason: '${event.reason}'`);
+    console.error(`disconnected from ${this.address} code: '${code}' reason: '${reason.toString()}'`);
     setTimeout((): void => {
       this.connect();
     }, 1000);
   };
 
-  private onSocketMessage = ({data: dataStr}: IMessageEvent) => {
+  private onSocketMessage = (dataStr: WebSocket.Data) => {
     try {
-      const data = JSON.parse(String(dataStr));
+      const data = JSON.parse(dataStr.toString());
       if (data.id !== undefined && data.id !== null && this.handlers[data.id]) {
         const [resolve, reject] = this.handlers[data.id];
         delete this.handlers[data.id];