# What changed in ws

> 14 changes in ws 7 to 8 from its official release notes, upgrade guides and advisories: 2 breaking, 2 security, 6 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/ws/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## ws 8

### Breaking changes

- The server now rejects offers whose client_max_window_bits is smaller than configured clientMaxWindowBits. (8.21.3) — [release notes](https://github.com/websockets/ws/releases/tag/8.21.3)
- The default value of maxFragments has been reduced. (8.21.1) — [release notes](https://github.com/websockets/ws/releases/tag/8.21.1)

### Security

- Fixed a vulnerability where tiny fragments and data chunks could crash a ws server or client due to OOM. (5.2.5 … 8.21.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.21.0), [security advisory](https://github.com/advisories/GHSA-96HV-2XVQ-FX4P)
- Prevents uninitialized memory disclosure when an unsupported TypedArray is passed as the reason argument. (8.20.1) — [release notes](https://github.com/websockets/ws/releases/tag/8.20.1), [security advisory](https://github.com/advisories/GHSA-58QX-3VCG-4XPX)

### New APIs and options

- Introduced the protocols option. (8.22.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.22.0)
- Introduced maxBufferedChunks to configure buffering limits. (8.21.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.21.0)
- Introduced maxFragments to configure fragment limits. (8.21.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.21.0)
- The PerMessageDeflate class is now exported for developer use. (8.20.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.20.0)
- Utilities for the Sec-WebSocket-Extensions header are now exported. (8.20.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.20.0)
- Added the closeTimeout option. (8.19.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.19.0)

### Behavior and default changes

- The default value of maxBufferedChunks has been reduced. (8.21.1) — [release notes](https://github.com/websockets/ws/releases/tag/8.21.1)

### Fixes and other changes

- Invalid arguments no longer transition the state to WebSocket.CLOSING. (8.22.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.22.0)
- Handled a forthcoming breaking change in Node.js core. (8.19.0) — [release notes](https://github.com/websockets/ws/releases/tag/8.19.0)

## ws 7

### Fixes and other changes

- Fixed the fragment counter failing to reset, restoring the expected reset behavior. (5.2.7, 6.2.6, 7.5.13) — [release notes](https://github.com/websockets/ws/releases/tag/7.5.13), [release notes](https://github.com/websockets/ws/releases/tag/6.2.6), [release notes](https://github.com/websockets/ws/releases/tag/5.2.7)