Update development toolchain to resolve audit advisories - #131
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the six development-toolchain audit findings recorded during 1.2.1 by updating the lockfile within the existing dependency ranges. Closes #130.
Vitest 4.1.11, Cloudflare Vitest plugin 1.1.13, Wrangler 4.135.0, and their transitive dependencies bring sharp to 0.35.4. Every changed package entry is development-only; production dependency entries, package ranges, and release version are unchanged.
Validation: full and production npm audits both zero; clean npm ci; lint; 1,001 tests passed / one skipped; release controls 46 passed / six Windows skips; packed-package checks (both binaries, 25 tools, correct handshake) and seven offline demo steps; cloud lint, eight tests, and dry-run build. Independent reviews completed; all CI checks required before merge.
Review receipt at exact SHA 0b15175: authenticated Claude claude-sonnet-5; tool-free Hermes/OpenRouter thinkingmachines/inkling:free and nvidia/nemotron-3.5-lightning:free (live prompt/completion pricing confirmed zero). Public semantic-diff packet inspected before transfer; no private context or credentials. No blocking findings or requested code changes. Lead verified all 64 changed lock entries are dev=true before and after; no package entries added or removed, root metadata and production entries are identical.
Primary review requested verification of tightened transitive ranges: npm ls --all exits 0 with no problems. Ubuntu cloud tests/native workerd checks pass in CI; Windows Node 22/24 CI is required before merge. Miniflare remains the upstream alpha pinned by the stable Cloudflare packages, as before. No new tests were added for this generated lockfile update; existing behavior, packaging, cloud, and release controls were exercised.
CI attempt 1: Windows Node 22 reached the existing 120-second timeout during the clean tarball's npm install (scripts/test-package.mjs:44), with empty child stdout/stderr. The package test and package.json are unchanged, and the install uses --omit=dev; local Windows Node 22.23.2 and the other three CI jobs passed. Reran the failed job at the identical reviewed SHA; no threshold changes or bypass. Waiting for a successful rerun before merge; the root cause is not established by this timeout alone.
Final outcome: CI attempt 2 passed at the same reviewed SHA; Windows Node 22 completed in 1m33s. All eight checks green. Merged as 1cfc791; issue #130 closed. No test code, timeout, workflow, or package-version changes were needed.