chore(deps): migrate nhooyr.io/websocket to github.com/coder/websocket

nhooyr.io/websocket now resolves to github.com/nhooyr/websocket-old and its
README is a one-line deprecation pointing at coder/websocket. Its last three
releases (v1.8.15-17) all shipped on 2024-08-10 as the redirect; the fork has
shipped through 2026-06-15.

The version number decreases (v1.8.17 -> v1.8.15) because both paths tagged in
the same space, but the coder release is ~2 years newer. Import path only; the
9 API symbols used are unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Server/api/livekit_proxy.go

@@ -10,7 +10,7 @@ import (
 	"net/url"
 	"strings"
 
-	"nhooyr.io/websocket"
+	"github.com/coder/websocket"
 )
 
 // NewLiveKitProxy creates a reverse proxy handler that forwards both HTTP

Server/go.mod

@@ -5,6 +5,7 @@ go 1.25.0
 require (
 	aead.dev/minisign v0.3.0
 	github.com/BurntSushi/toml v1.6.0
+	github.com/coder/websocket v1.8.15
 	github.com/corazawaf/coraza/v3 v3.6.0
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/google/uuid v1.6.0
@@ -32,7 +33,6 @@ require (
 	golang.org/x/crypto v0.51.0
 	golang.org/x/mod v0.35.0
 	modernc.org/sqlite v1.48.0
-	nhooyr.io/websocket v1.8.17
 )
 
 require (

Server/go.sum

@@ -40,6 +40,8 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
+github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -450,7 +452,5 @@ modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-nhooyr.io/websocket v1.8.17 h1:KEVeLJkUywCKVsnLIDlD/5gtayKp8VoCkksHCGGfT9Y=
-nhooyr.io/websocket v1.8.17/go.mod h1:rN9OFWIUwuxg4fR5tELlYC04bXYowCP9GX47ivo2l+c=
 rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=

Server/ws/client.go

@@ -51,8 +51,8 @@ type Client struct {
 	voiceMu        syncutil.Mutex // guards voiceChID and voiceJoinToken
 }
 
-// wsConn is the subset of nhooyr.io/websocket.Conn used by writePump/readPump.
-// Defining it as an interface lets us avoid importing nhooyr.io/websocket here,
+// wsConn is the subset of github.com/coder/websocket.Conn used by writePump/readPump.
+// Defining it as an interface lets us avoid importing github.com/coder/websocket here,
 // keeping the core hub logic free from that dependency during unit tests.
 type wsConn interface {
 	// intentionally empty — methods used only in serve.go/client_pump.go

Server/ws/origin.go

@@ -3,7 +3,7 @@ package ws
 import (
 	"log/slog"
 
-	"nhooyr.io/websocket"
+	"github.com/coder/websocket"
 )
 
 // OriginAcceptOptions builds a *websocket.AcceptOptions that enforces origin

Server/ws/reconnect_db_test.go

@@ -16,7 +16,7 @@ import (
 	"testing"
 	"time"
 
-	"nhooyr.io/websocket"
+	"github.com/coder/websocket"
 
 	"github.com/owncord/server/auth"
 	"github.com/owncord/server/db"

Server/ws/serve.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"nhooyr.io/websocket"
+	"github.com/coder/websocket"
 
 	"github.com/owncord/server/auth"
 	"github.com/owncord/server/config"

Server/ws/ws_integration_test.go

@@ -2,7 +2,7 @@ package ws_test
 
 // ws_integration_test.go covers ServeWS, authenticateConn, writePump, and
 // readPump by spinning up a real httptest server and dialing it with the
-// nhooyr.io/websocket client.
+// github.com/coder/websocket client.
 
 import (
 	"context"
@@ -13,7 +13,7 @@ import (
 	"testing"
 	"time"
 
-	"nhooyr.io/websocket"
+	"github.com/coder/websocket"
 
 	"github.com/owncord/server/auth"
 	"github.com/owncord/server/service"
@@ -42,7 +42,7 @@ func TestServeWS_InvalidUpgrade_ReturnsError(t *testing.T) {
 	}
 	defer func() { _ = resp.Body.Close() }()
 
-	// nhooyr.io/websocket returns 400 or 426 when upgrade is absent.
+	// github.com/coder/websocket returns 400 or 426 when upgrade is absent.
 	if resp.StatusCode == 200 {
 		t.Errorf("expected non-200 for plain HTTP, got %d", resp.StatusCode)
 	}
@@ -823,7 +823,7 @@ func TestServeWS_FreshReconnect_CleansStaleVoiceState(t *testing.T) {
 	ws.SetClientVoiceStateForTest(originalClient, chID, vsBeforeReload.JoinedAt)
 
 	// Connect the observer (will receive broadcasts).
-	// Do NOT drain the observer — nhooyr.io/websocket closes the conn
+	// Do NOT drain the observer — github.com/coder/websocket closes the conn
 	// when a Read context expires. Instead, collect all messages below
 	// and filter for voice_leave in the assertion.
 	obsConn := dialAndAuthFresh(obsToken)