Skip to content

factory: weekly upgrades 2026-10-19 - #2

Merged
pid1 merged 3 commits into
mainfrom
factory/2026-10-19
Oct 19, 2026
Merged

pid1 merged 3 commits into
mainfrom
factory/2026-10-19

Conversation

@pid1

@pid1 pid1 commented Oct 19, 2026

Copy link
Copy Markdown
Owner

Runtimes

  • Node 22 → 24 (Active LTS) in CI (ci.yml, cf-fallback.yml). The repo has no .nvmrc, engines or @types/node to update. README/landing page still say "Node 22+", which remains the true minimum, so copy is unchanged.
  • Cloudflare compatibility_date left at 2026-08-22: under a quarter old.

Dependencies

  • wrangler 4.135.0 → 4.151.2
  • @cloudflare/workers-types 5.20260918.1 → 5.20261019.1
  • typescript 5.9.3 → 7.0.2 (major: native compiler; config uses Bundler/ES2022, nothing removed in 7 applies, typecheck clean)
  • vitest 4.1.11 → 5.0.5 (major: config and suite run unchanged)
  • replaced deprecated @cloudflare/vitest-pool-workers 0.22.0 with @cloudflare/vitest-plugin 1.4.5 (npm marks the old package as renamed and no longer updated; same cloudflareTest() API, import updated in vitest.config.ts, README and CI comment)
  • transitive via miniflare: sharp 0.35.2/0.35.4 → 0.35.5 (GHSA-wq5f-xc86-pv6w), undici 7.29.0 → 7.29.1

CI

  • actions/checkout v4 (ci.yml) / v6 (semgrep.yml) → v7.0.1, SHA-pinned
  • actions/setup-node v4 (ci.yml) / v7.0.0 (cf-fallback.yml) → v7.1.0, SHA-pinned
  • semgrep/semgrep container pinned to 1.181.0 by digest

Semgrep

  • fixed: 979833868, 979833867 (github-actions-mutable-action-tag) in .github/workflows/ci.yml:15,17
  • fixed: 979833866 (github-actions-mutable-action-tag) in .github/workflows/semgrep.yml:25
  • fixed (SCA): 1012865897, 1012865896 (sharp, GHSA-wq5f-xc86-pv6w) via sharp 0.35.5
  • fixed (SCA): 987696247–987696254 (undici, 8 CVEs) via undici 7.29.1
  • semgrep ci --dry-run with the org policy: 0 findings

Holds

  • none

Verification

npm run typecheck: clean. npm test: 38 passed (4 files). wrangler deploy --dry-run: builds.

🤖 Generated with Claude Code

Jonathan Roemer and others added 3 commits October 19, 2026 09:44
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- wrangler 4.135.0 -> 4.151.2
- @cloudflare/workers-types 5.20260918.1 -> 5.20261019.1
- typescript 5.9.3 -> 7.0.2
- vitest 4.1.11 -> 5.0.5
- @cloudflare/vitest-pool-workers 0.22.0 (deprecated, renamed) ->
  @cloudflare/vitest-plugin 1.4.5; same cloudflareTest() API
- transitive: sharp 0.35.2/0.35.4 -> 0.35.5 (GHSA-wq5f-xc86-pv6w),
  undici 7.29.0 -> 7.29.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- actions/checkout v4/v6 -> v7.0.1 (SHA-pinned)
- actions/setup-node v4/v7.0.0 -> v7.1.0 (SHA-pinned)
- semgrep/semgrep container pinned to 1.181.0 by digest

Fixes Semgrep github-actions-mutable-action-tag findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@pid1
pid1 merged commit 3439390 into main Oct 19, 2026
2 checks passed
@pid1
pid1 deleted the factory/2026-10-19 branch October 19, 2026 19:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant