chore(deps): refresh worker dependencies

[steipete]

Summary

• refresh policy-eligible Cloudflare worker dependency overrides and lockfile entries
• pin nanoid 3.3.18 at the pnpm workspace override boundary to resolve GHSA-2v37-7h3g-55p8
• retain the existing 24-hour minimum-release-age policy; @cloudflare/workers-types 5.20260810.1 remains held until eligible

Validation

• make ci
• pnpm -C internal/tracking/worker format:check
• pnpm -C internal/tracking/worker typecheck
• make worker-ci
• pnpm -C internal/tracking/worker audit
• go run golang.org/x/vuln/cmd/govulncheck@latest ./...
• make build && ./bin/gog version --json
• autoreview clean

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 10, 2026, 2:31 AM ET / 06:31 UTC.

ClawSweeper review

What this changes

Refreshes the Cloudflare tracking worker’s pnpm overrides and lockfile resolutions, pinning nanoid 3.3.18 and updating related worker build dependencies.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open: this is a narrow collaborator-authored dependency refresh whose override and lockfile changes are internally consistent; the remaining action is normal required-check completion.

Priority: P2
Reviewed head: 115fe5a19e67f92c0dbdd1f595dc9851eb4c094b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent dependency refresh with stated validation and no actionable patch defect found.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored dependency metadata update has no directly user-visible behavior to demonstrate; the PR body records worker build, test, audit, and vulnerability checks.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored dependency metadata update has no directly user-visible behavior to demonstrate; the PR body records worker build, test, audit, and vulnerability checks.
Evidence reviewed	4 items	Narrow, consistent dependency diff: The branch changes only the worker workspace override policy and its generated lockfile; nanoid is pinned at the same override boundary in both files, while the 24-hour minimum-release-age policy remains unchanged. Lockfile resolution audit: The full lockfile diff updates only resolutions associated with the declared overrides and their dependent snapshots; no package source, lifecycle script, or registry configuration is changed. Policy ownership provenance: The current worker dependency policy, including its release-age setting and prior override block, was introduced in the v0.35.0 release preparation by Peter Steinberger.
Findings	None	None.
Security	None	None.

How this fits together

The tracking worker is a separate Cloudflare Worker package within the Go CLI repository. Its pnpm workspace policy selects transitive dependency versions, which the lockfile resolves for worker lint, build, and test commands.

flowchart LR
  A[Worker package manifest] --> B[pnpm workspace policy]
  B --> C[Dependency overrides]
  C --> D[Lockfile resolutions]
  D --> E[Worker lint build and tests]
  E --> F[Cloudflare tracking worker]

Loading

Before merge

• Complete next step (P2) - No discrete repair is needed; wait for the remaining required checks on this collaborator-authored PR.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency resolution scope	2 files; 153 added, 151 removed	The apparent size is lockfile resolution churn; the only policy change is six centralized override entries.

Technical review

Best possible solution:

Land the centralized override and matching lockfile refresh once the remaining required CI checks complete successfully.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance rather than a report of a reproducible product failure; the branch’s worker checks are the relevant validation path.

Is this the best way to solve the issue?

Yes: applying the nanoid pin and related updates at the existing pnpm workspace override boundary is the narrowest maintainable solution and keeps the lockfile aligned.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 229da12809c1.

Labels

Label changes:

• add P2: This is a bounded worker dependency and vulnerability-remediation update with no demonstrated urgent user-facing outage.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored dependency metadata update has no directly user-visible behavior to demonstrate; the PR body records worker build, test, audit, and vulnerability checks.

Label justifications:

• P2: This is a bounded worker dependency and vulnerability-remediation update with no demonstrated urgent user-facing outage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored dependency metadata update has no directly user-visible behavior to demonstrate; the PR body records worker build, test, audit, and vulnerability checks.

Evidence

What I checked:

• Narrow, consistent dependency diff: The branch changes only the worker workspace override policy and its generated lockfile; nanoid is pinned at the same override boundary in both files, while the 24-hour minimum-release-age policy remains unchanged. (internal/tracking/worker/pnpm-workspace.yaml:28, 115fe5a19e67)
• Lockfile resolution audit: The full lockfile diff updates only resolutions associated with the declared overrides and their dependent snapshots; no package source, lifecycle script, or registry configuration is changed. (internal/tracking/worker/pnpm-lock.yaml:8, 115fe5a19e67)
• Policy ownership provenance: The current worker dependency policy, including its release-age setting and prior override block, was introduced in the v0.35.0 release preparation by Peter Steinberger. (internal/tracking/worker/pnpm-workspace.yaml:5, 402def5041d6)
• Whitespace check: The proposed diff has no whitespace errors. (115fe5a19e67)

Likely related people:

• steipete: Current-main blame attributes the worker workspace policy to Peter Steinberger, and recent history also includes the current lockfile path. (role: original worker dependency-policy author and recent area contributor; confidence: high; commits: 402def5041d6, 229da12809c1; files: internal/tracking/worker/pnpm-workspace.yaml, internal/tracking/worker/pnpm-lock.yaml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Allow the in-progress cross-platform and image checks to finish before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.