[HIGH] Bump ws to 7.5.13

[OskarEichler]

Summary:

Bumps the direct ws dependency from 7.5.10 to 7.5.13 across the root workspace, React Native package, and dev middleware. This resolves GHSA-96hv-2xvq-fx4p / CVE-2026-48779, a high-severity memory-exhaustion denial of service reachable from WebSocket peers through many tiny fragments and data chunks.

The lockfile entry is consolidated so compatible transitive 7.x consumers, including Metro and react-devtools-core, also resolve to 7.5.13. The unrelated 6.x CLI dependency remains unchanged.

Changelog:

[GENERAL] [SECURITY] - Update ws to a release that prevents memory exhaustion from tiny fragments.

Test Plan:

• yarn install --frozen-lockfile --ignore-scripts
• yarn why ws confirms all compatible 7.x consumers resolve to 7.5.13
• yarn audit --groups dependencies no longer reports GHSA-96hv-2xvq-fx4p
• NODE_OPTIONS=--experimental-vm-modules yarn jest packages/dev-middleware --runInBand --silent
  • 11 suites passed
  • 135 tests passed
  • 1 snapshot passed
  • Jest retained a pre-existing open handle after reporting success, so the completed process was interrupted after the full result was printed
• git diff --check