[pid1]

Runtimes

• No change. Node 24 (Active LTS) in CI; compatibility_date 2026-08-22 is under a quarter old, left as is.

Dependencies

• No upgrades: every direct dependency is already on its newest release at least 7 days old.
• Re-resolved under the cooldown (floors lowered, lockfile regenerated). These releases from the 2026-10-19 run are now under 7 days old:
  • wrangler 4.151.2 → 4.151.0
  • @cloudflare/vitest-plugin 1.4.5 → 1.4.3
  • @cloudflare/workers-types 5.20261019.1 → 5.20261015.1
  • workerd (and @cloudflare/workerd-* binaries) 1.20261019.1 → 1.20261012.1 (transitive)
  • miniflare 5.20261019.0-beta → 5.20261012.0-beta (transitive)
  • postcss 8.5.31 → 8.5.30 (transitive)
• None of the dropped releases fixes a published advisory (checked GitHub advisories and Semgrep SCA).

CI

• ci.yml: new step that fails if the runner's npm is older than 11.10 (which would ignore min-release-age). Node 24 bundles npm 11.19.1.
• No action changes; all actions already SHA-pinned to releases over 7 days old.

Supply chain

• added .npmrc min-release-age=7 (days, npm 11.10+; key checked against npm help config)
• added engines.npm >=11.10.0 to package.json
• no Dependabot/Renovate config in this repo
• cooldown exceptions: none

Semgrep

• No untriaged findings (SAST or SCA). semgrep ci --dry-run: 0 findings, 172 dependencies from package-lock.json.

Holds

• none

Verification

npm ci && npm run typecheck && npm test: typecheck clean, 38 tests passed (4 files)

Needs you

• Cloudflare Workers Builds installs with npm 10.9.2, which ignores min-release-age. Change the build command in the Cloudflare dashboard to use npx -y npm@11.21.0 ci. Until then the cooldown-clean lockfile is the gate.

🤖 Generated with Claude Code

[pid1]

Closing: the Cygnus software factory is retired. Sadr (https://sadr.cygnusstrategy.com), a dark factory for software, replaces it and redoes this work in its own upkeep PR. Reopen this PR if you want its changes before Sadr runs.