[sadrbot]

What this PR does

Sadr moved Node to the new 26 LTS line, updated the Cloudflare dev dependencies, and moved the Semgrep CI image. It also overrode workerd to 1.20261101.1, which fixes the Brotli advisory GHSA-cust-0000-0034 behind all six open Semgrep findings, and moved compatibility_date to the newest date that workerd supports.

Changes

• Node 24.22.1 → 26.13.0 (setup-node in ci.yml, kosync-conformance.yml and cf-fallback.yml, and "Node 26" in README.md)
• compatibility_date 2026-08-01 → 2026-11-01 (wrangler.toml, and compatibilityDate in vitest.config.ts so the tests run at the same date). This turns on nodejs_compat, nodejs_compat_v2, spec_compliant_dispatch_exceptions, workflows_enable_fast_engine_creation and durable_object_io_tasks_prevent_eviction by default.
• wrangler 4.151.2 → 4.156.0
• @cloudflare/vitest-plugin 1.4.5 → 1.4.11
• @cloudflare/workers-types 5.20261019.1 → 5.20261101.1
• miniflare 5.20261019.0-beta → 5.20261023.3-beta (transitive, pinned exactly by wrangler and vitest-plugin)
• workerd 1.20261019.1 → 1.20261101.1 and its five @cloudflare/workerd-* platform packages, through a new overrides entry in package.json, because wrangler 4.156.0 and miniflare pin workerd 1.20261023.1 exactly. allowScripts names the new workerd version.
• package-lock.json regenerated with the 7-day cooldown, so a few transitive packages moved too (rolldown 1.2.14 → 1.2.16, vite 8.3.4 → 8.3.5, tslib 2.8.1 → 2.9.1 and others)
• semgrep/semgrep 1.181.0 → 1.183.0 (.github/workflows/semgrep.yml, pinned by digest)

Supply chain

• cooldown: unchanged (npm min-release-age=7 in .npmrc)
• pins: semgrep/semgrep:1.183.0@sha256:2e45517a85e13a9cca14a2a00df6bb48affd66b8ebfae1b0991cd57578362fb0 (published 2026-10-29). actions/checkout v7.0.1, actions/setup-node v7.1.0 and actions/upload-artifact v7.0.2 are unchanged and already on their newest pins.
• cooldown exceptions: none
• inside the cooldown (already merged): none
• waiting for cooldown: wrangler 4.158.0 (clears 2026-11-12T10:45Z), @cloudflare/vitest-plugin 1.6.0 (clears 2026-11-12T10:49Z), @cloudflare/workers-types 5.20261108.1 (clears 2026-11-15T01:04Z), vitest 5.1.0 (clears 2026-11-09T16:12Z), semgrep/semgrep 1.184.0 (clears 2026-11-12T19:17Z)

Security findings

• untriaged: 6 → 0 (Semgrep API and semgrep ci --dry-run)
• open: 6 → 0 (on this branch's dry run. The default branch's scan sees 6 until this PR merges.)
• fixed: 6 (workerd 1.20261019.1 → 1.20261101.1: GHSA-cust-0000-0034 on workerd and @cloudflare/workerd-darwin-64, -darwin-arm64, -linux-64, -linux-arm64 and -windows-64)
• false positive: 0
• accepted risk: 0
• other: 0
• suppressions reviewed: 0

Holds

• lifted: cooldown exception Node 24.22.1 for CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074 and CVE-2026-111497, cleared 2026-10-28T10:38Z (ci.yml, kosync-conformance.yml, cf-fallback.yml). Node 26.13.0 replaces the pin.
• honored: none

AGENTS.md

• Sadr wrote four facts in sadr: AGENTS.md facts 2026-11-08 #21: the vitest compatibilityDate that must match wrangler.toml and the wrangler deploy --dry-run build check (### Build and test), the untagged pid1/kosync-conformance repo (### Toolchain), and the npm 10.9.2 and Node 24.22.1 that Workers Builds uses (### Deploys outside CI).

Merging

• auto-merge: all (owner Settings in pid1/.github, upkeep PRs)
• turned on auto-merge (merge). GitHub merges after the required checks check and semgrep/ci pass.

Needs you

• Workers Builds installs with its default npm 10.9.2, which ignores min-release-age in .npmrc. To apply the cooldown there, add "packageManager": "npm@11.20.0" to package.json.

Verification

• npm ci on Node 26.13.0 with npm 11.20.0: 73 packages, no warnings
• npm run typecheck: clean
• npm test: 13 files, 125 tests passed
• npm run db:migrate:local, then wrangler dev on port 8791: GET /healthcheck answered {"state":"OK"}
• kosync conformance verify.mjs (pid1/kosync-conformance at 215501b8e6af0d3a78ccaa4c3885f5b397cd4301), with the second account and --registration-off as kosync-conformance.yml runs it: 47 passed, 0 failed, 2 skipped, "conformant (every MUST satisfied)"
• wrangler deploy --dry-run --outdir: the bundle at 2026-11-01 is byte-identical to the bundle at 2026-08-01. Nothing was uploaded.
• semgrep ci --dry-run on main: 6 supply-chain findings, 0 code findings, 172 dependencies. On this branch: 0 findings, 172 dependencies.
• python3 scripts/lockage.py --min-age-days 7 package-lock.json: 172 entries, 0 younger than 7 days, 0 that cannot be dated
• pins.py check on all four workflows: 12 pins checked, 0 problems
• main was green before the change: npm ci, typecheck and 125 tests passed on Node 24.22.2
• gitleaks 8.30.1 on the new commits: no leaks

Run

• 10 minutes, US$3.14

Not done or not checked

• The new compatibility date changes runtime flags in production. Sadr tested it in local workerd 1.20261101.1 with the test suite, wrangler dev and the kosync check, not on Cloudflare's own runtime.
• kosync-conformance.yml clones pid1/kosync-conformance at its default branch. That repo has no release tags, so Sadr cannot pin the clone to a tag's commit.
• Workers Builds deploys with its default Node 24.22.1, because the repo has no .node-version file. Node only runs wrangler there. Sadr cannot see the Workers Builds environment.
• PLAN.md and test/bench/wrangler.toml still show compatibility_date = "2026-08-01". PLAN.md is a design record, and test/bench is a separate throwaway Worker, so Sadr left both alone.
• Semgrep does not parse CSS, so public/app.css has no code rules.

🤖 Generated with Claude Code

---

Opened by Sadr, a dark factory for software.