[PR #1891] [MERGED] build(deps): bump undici and wrangler in /interviews/staffml-vault-worker #36509

New Issue

GiteaMirror · 2026-07-16T00:24:23-05:00

GiteaMirror commented

2026-07-16 00:24:23 -05:00

📋 Pull Request Information

Original PR: https://github.com/harvard-edge/cs249r_book/pull/1891
Author: @dependabot[bot]
Created: 6/20/2026
Status: ✅ Merged
Merged: 6/21/2026
Merged by: @profvjreddi

Base: dev ← Head: dependabot/npm_and_yarn/interviews/staffml-vault-worker/multi-7695d9a7fd

📝 Commits (1)

33fe54a build(deps): bump undici and wrangler

📊 Changes

2 files changed (+1720 additions, -1732 deletions)

View changed files

📝 interviews/staffml-vault-worker/package-lock.json (+1719 -1731)
📝 interviews/staffml-vault-worker/package.json (+1 -1)

📄 Description

Bumps undici to 7.28.0 and updates ancestor dependency wrangler. These dependencies need to be updated together.

Updates undici from 7.24.8 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

f9eba0a Bumped v7.28.0 (#5430)
a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
8cb10f9 websocket: limit the number of fragments in a message
04201f8 fix: honor requestTls when proxy is SOCKS5
fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
85a2405 fix(cache): trim qualified field names
Additional commits viewable in compare view

Updates wrangler from 4.95.0 to 4.103.0

Release notes

Sourced from wrangler's releases.

wrangler@4.103.0

Minor Changes

#14295 cfd6205 Thanks @dario-piotrowicz! - Move unstable_getWorkerNameFromProject from wrangler to @cloudflare/workers-utils

The unstable_getWorkerNameFromProject export has been removed from the wrangler package. This function is now available as getWorkerNameFromProject (without the unstable_ prefix) from @cloudflare/workers-utils. If you were importing this function from wrangler, update your import to use @cloudflare/workers-utils instead.

#14295 cfd6205 Thanks @dario-piotrowicz! - Remove experimental autoconfig exports

The experimental autoconfig exports (experimental_getDetailsForAutoConfig, experimental_runAutoConfig, experimental_AutoConfigFramework) have been removed. This logic has been moved to the @cloudflare/autoconfig package (without the experimental_ prefixes since the package itself is pre-v1).

Patch Changes

#14366 c6579d3 Thanks @jamesopstad! - Resolve relative cf-worker entrypoint imports relative to the importing module

When loading the experimental cloudflare.config.ts, a relative entrypoint imported with import ... with { type: "cf-worker" } (e.g. ./src/index.ts) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.

Bare specifiers (such as @scope/pkg) and virtual modules (such as virtual:foo) are still left unresolved so that consumers can apply their own resolution.

#14316 444b75e Thanks @matingathani! - Prevent wrangler dev crash when source-mapping a truncated error chunk

When a worker logs many errors in quick succession, the stderr chunks received by wrangler dev can be truncated mid-stack-frame, leaving a call site with an invalid column number. The source map library throws in that case, which was crashing the wrangler process entirely. The error is now caught and the original (un-source-mapped) text is returned instead.

#14118 b38823f Thanks @aicayzer! - Fix Uint8Array step outputs in local Workflows being persisted with the full backing ArrayBuffer

A Uint8Array returned from a Workflows step under wrangler dev was serialised together with its full underlying ArrayBuffer, causing a raw SQLITE_TOOBIG error at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern from crypto.getRandomValues or arr.slice(...) on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes #14101.

Updated dependencies [b38823f]:

miniflare@4.20260617.1

wrangler@4.102.0

Minor Changes

#14340 f6e49dd Thanks @emily-shen! - Add cf-wrangler build delegate support

The experimental cf-wrangler delegate binary now accepts build and emits the Build Output API directory through Wrangler's new-config build path. This lets parent tools invoke Wrangler's build-output implementation with cf-wrangler build instead of shelling out through the public Wrangler CLI.

#14324 36777db Thanks @jamesopstad! - Add experimental --experimental-cf-build-output flag to wrangler build

When used alongside --experimental-new-config, wrangler build now emits a self-contained Build Output API directory under .cloudflare/output/v0/ instead of delegating to wrangler deploy --dry-run.

Patch Changes

#14347 673b09e Thanks @jamesopstad! - Update undici from 7.24.8 to 7.28.0

#14346 e930bd4 Thanks @haidargit! - Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p

GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a ws server or client via OOM. The fix shipped in ws@8.21.0 (commit 2b2abd45, released 2026-05-22), which also introduces the maxBufferedChunks and maxFragments options. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.

#14314 5c3bb11 Thanks @harryzcy! - Bump esbuild to 0.28.1

... (truncated)

Commits

4d8ffcb Version Packages (#14353)
7649895 move auto provisioning to deploy-helpers (#14354)
cfd6205 Extract autoconfig in its own standalone package (#14295)
dd7e101 Version Packages (#14327)
5dfb788 Support dev.plugin on typed services bindings (#14269)
296ad65 Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
f6e49dd add build command to cf-wrangler (#14340)
36777db Wrangler support for experimental Build Output API (#14324)
a79b899 [wrangler] fix: respect find_additional_modules when no_bundle is set (#14315)
5c3bb11 Bump esbuild to 0.28.1 (#14314)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/harvard-edge/cs249r_book/pull/1891 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 6/20/2026 **Status:** ✅ Merged **Merged:** 6/21/2026 **Merged by:** [@profvjreddi](https://github.com/profvjreddi) **Base:** `dev` ← **Head:** `dependabot/npm_and_yarn/interviews/staffml-vault-worker/multi-7695d9a7fd` --- ### 📝 Commits (1) - [`33fe54a`](https://github.com/harvard-edge/cs249r_book/commit/33fe54ae4a59b7228ef9d3d10c4f106d5a812199) build(deps): bump undici and wrangler ### 📊 Changes **2 files changed** (+1720 additions, -1732 deletions) <details> <summary>View changed files</summary> 📝 `interviews/staffml-vault-worker/package-lock.json` (+1719 -1731) 📝 `interviews/staffml-vault-worker/package.json` (+1 -1) </details> ### 📄 Description Bumps [undici](https://github.com/nodejs/undici) to 7.28.0 and updates ancestor dependency [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies need to be updated together. Updates `undici` from 7.24.8 to 7.28.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v7.28.0</h2> <h1>⚠️ Security Release</h1> <p>This release line addresses <strong>7 security advisories</strong>, all shipped in <strong>v7.28.0</strong>.</p> <blockquote> <p><strong>Action required:</strong> Upgrade to <strong>undici 7.28.0</strong> or later.</p> <pre lang="sh"><code>npm install undici@^7.28.0 </code></pre> </blockquote> <p>The v7 line is <strong>not</strong> affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.</p> <blockquote> <p><strong>Note on GHSA-hm92-r4w5-c3mj:</strong> this fix shipped in <strong>v7.28.0</strong>, not the earlier 7.2x line — the vulnerable single-pool code was still present through <code>v7.27.2</code>. The per-origin pool fix is <a href="https://github.com/nodejs/undici/commit/3805b8f8"><code>3805b8f8</code></a> (<a href="https://redirect.github.com/nodejs/undici/pull/5041">#5041</a>).</p> </blockquote> <h2>Summary</h2> <table> <thead> <tr> <th>Advisory</th> <th>CVE</th> <th>Severity (CVSS)</th> <th>Fixed in</th> <th>Fix commit</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q">GHSA-vxpw-j846-p89q</a></td> <td>CVE-2026-12151</td> <td>High (7.5)</td> <td>7.28.0</td> <td><a href="https://github.com/nodejs/undici/commit/8cb10f98"><code>8cb10f98</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g">GHSA-vmh5-mc38-953g</a></td> <td>CVE-2026-9697</td> <td>High (7.4)</td> <td>7.28.0</td> <td><a href="https://github.com/nodejs/undici/commit/04201f89"><code>04201f89</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj">GHSA-hm92-r4w5-c3mj</a></td> <td>CVE-2026-6734</td> <td>High (7.5)</td> <td>7.28.0</td> <td><a href="https://github.com/nodejs/undici/commit/3805b8f8"><code>3805b8f8</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6">GHSA-pr7r-676h-xcf6</a></td> <td>CVE-2026-9678</td> <td>Moderate (5.9)</td> <td>7.28.0</td> <td><a href="https://github.com/nodejs/undici/commit/85a24055"><code>85a24055</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv">GHSA-p88m-4jfj-68fv</a></td> <td>CVE-2026-9679</td> <td>Moderate (5.9)</td> <td>7.28.0</td> <td><a href="https://github.com/nodejs/undici/commit/d0574cc4"><code>d0574cc4</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m">GHSA-g8m3-5g58-fq7m</a></td> <td>CVE-2026-11525</td> <td>Low (3.7)</td> <td>7.28.0</td> <td><a href="https://github.com/nodejs/undici/commit/d0574cc4"><code>d0574cc4</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52">GHSA-35p6-xmwp-9g52</a></td> <td>CVE-2026-6733</td> <td>Low (3.7)</td> <td>7.28.0</td> <td><a href="https://github.com/nodejs/undici/commit/ea8930cf"><code>ea8930cf</code></a></td> </tr> </tbody> </table> <hr /> <h2>High severity</h2> <h3>WebSocket DoS via fragment count bypass — CVE-2026-12151</h3> <p><strong><a href="https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q">GHSA-vxpw-j846-p89q</a></strong> · CWE-400, CWE-770 <strong>Fix:</strong> <a href="https://github.com/nodejs/undici/commit/8cb10f98"><code>8cb10f98</code></a> <em>websocket: limit the number of fragments in a message</em> (part of backport <a href="https://github.com/nodejs/undici/commit/a027a4a0"><code>a027a4a0</code></a> <em>Backport WebSocket maxPayloadSize fixes to v7.x</em>, <a href="https://redirect.github.com/nodejs/undici/pull/5423">#5423</a>)</p> <p>A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the <em>number</em> of fragments per message, leading to unbounded memory growth and denial of service.</p> <ul> <li><strong>Affected:</strong> applications using <code>new WebSocket(...)</code> or <code>WebSocketStream</code> against untrusted endpoints.</li> <li><strong>Workaround:</strong> none — upgrade is required.</li> </ul> <h3>TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697</h3> <p><strong><a href="https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g">GHSA-vmh5-mc38-953g</a></strong> · CWE-295</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/f9eba0ad9134e1c0977848476bba9d49734696e4"><code>f9eba0a</code></a> Bumped v7.28.0 (<a href="https://redirect.github.com/nodejs/undici/issues/5430">#5430</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/a027a4a04c6c055877d1abaf5f60ee4917e7e01f"><code>a027a4a</code></a> Backport WebSocket maxPayloadSize fixes to v7.x (<a href="https://redirect.github.com/nodejs/undici/issues/5423">#5423</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/8cb10f983eb6005dd53f3744d95d3b6d7dbcee0f"><code>8cb10f9</code></a> websocket: limit the number of fragments in a message</li> <li><a href="https://github.com/nodejs/undici/commit/04201f8947041f0f4f2ac865dbdb1677e46a8844"><code>04201f8</code></a> fix: honor requestTls when proxy is SOCKS5</li> <li><a href="https://github.com/nodejs/undici/commit/fcd642ff613ea9030dec87cf622e68d4b1ae9847"><code>fcd642f</code></a> fix(socks5): preserve dispatch backpressure return value (<a href="https://redirect.github.com/nodejs/undici/issues/5166">#5166</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/bc98c97906abf26fa1e959b2f6111b53ade0e18f"><code>bc98c97</code></a> fix(socks5): use configured connector in Socks5ProxyAgent (<a href="https://redirect.github.com/nodejs/undici/issues/5168">#5168</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/9e1c74372a2b27cacd92d27c13a83a6d84f10e0e"><code>9e1c743</code></a> fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (<a href="https://redirect.github.com/nodejs/undici/issues/5099">#5099</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/376c8be27cb40cc17ccaad6b6ebb317fa7148d65"><code>376c8be</code></a> fix(socks5): enforce authenticated state before CONNECT (<a href="https://redirect.github.com/nodejs/undici/issues/5097">#5097</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/3805b8f8518882991044048c256e005dc3c10a85"><code>3805b8f</code></a> fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...</li> <li><a href="https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9"><code>85a2405</code></a> fix(cache): trim qualified field names</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v7.24.8...v7.28.0">compare view</a></li> </ul> </details> <br /> Updates `wrangler` from 4.95.0 to 4.103.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/workers-sdk/releases">wrangler's releases</a>.</em></p> <blockquote> <h2>wrangler@4.103.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14295">#14295</a> <a href="https://github.com/cloudflare/workers-sdk/commit/cfd6205fe86f6afd74b5881f09524c93c83b8359"><code>cfd6205</code></a> Thanks <a href="https://github.com/dario-piotrowicz"><code>@dario-piotrowicz</code></a>! - Move <code>unstable_getWorkerNameFromProject</code> from wrangler to <code>@cloudflare/workers-utils</code></p> <p>The <code>unstable_getWorkerNameFromProject</code> export has been removed from the <code>wrangler</code> package. This function is now available as <code>getWorkerNameFromProject</code> (without the <code>unstable_</code> prefix) from <code>@cloudflare/workers-utils</code>. If you were importing this function from <code>wrangler</code>, update your import to use <code>@cloudflare/workers-utils</code> instead.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14295">#14295</a> <a href="https://github.com/cloudflare/workers-sdk/commit/cfd6205fe86f6afd74b5881f09524c93c83b8359"><code>cfd6205</code></a> Thanks <a href="https://github.com/dario-piotrowicz"><code>@dario-piotrowicz</code></a>! - Remove experimental autoconfig exports</p> <p>The experimental autoconfig exports (<code>experimental_getDetailsForAutoConfig</code>, <code>experimental_runAutoConfig</code>, <code>experimental_AutoConfigFramework</code>) have been removed. This logic has been moved to the <code>@cloudflare/autoconfig</code> package (without the <code>experimental_</code> prefixes since the package itself is pre-v1).</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14366">#14366</a> <a href="https://github.com/cloudflare/workers-sdk/commit/c6579d30bd6fd7705fe3f10c7655d74a0476df86"><code>c6579d3</code></a> Thanks <a href="https://github.com/jamesopstad"><code>@jamesopstad</code></a>! - Resolve relative <code>cf-worker</code> entrypoint imports relative to the importing module</p> <p>When loading the experimental <code>cloudflare.config.ts</code>, a relative entrypoint imported with <code>import ... with { type: "cf-worker" }</code> (e.g. <code>./src/index.ts</code>) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.</p> <p>Bare specifiers (such as <code>@scope/pkg</code>) and virtual modules (such as <code>virtual:foo</code>) are still left unresolved so that consumers can apply their own resolution.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14316">#14316</a> <a href="https://github.com/cloudflare/workers-sdk/commit/444b75e75492738d10e7dc89ec645f7e2fad6b97"><code>444b75e</code></a> Thanks <a href="https://github.com/matingathani"><code>@matingathani</code></a>! - Prevent <code>wrangler dev</code> crash when source-mapping a truncated error chunk</p> <p>When a worker logs many errors in quick succession, the stderr chunks received by <code>wrangler dev</code> can be truncated mid-stack-frame, leaving a call site with an invalid column number. The source map library throws in that case, which was crashing the wrangler process entirely. The error is now caught and the original (un-source-mapped) text is returned instead.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14118">#14118</a> <a href="https://github.com/cloudflare/workers-sdk/commit/b38823fb35a8bdcd00004e74404ab18d7b070dbf"><code>b38823f</code></a> Thanks <a href="https://github.com/aicayzer"><code>@aicayzer</code></a>! - Fix <code>Uint8Array</code> step outputs in local Workflows being persisted with the full backing <code>ArrayBuffer</code></p> <p>A <code>Uint8Array</code> returned from a Workflows step under <code>wrangler dev</code> was serialised together with its full underlying <code>ArrayBuffer</code>, causing a raw <code>SQLITE_TOOBIG</code> error at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern from <code>crypto.getRandomValues</code> or <code>arr.slice(...)</code> on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes <a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14101">#14101</a>.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/b38823fb35a8bdcd00004e74404ab18d7b070dbf"><code>b38823f</code></a>]:</p> <ul> <li>miniflare@4.20260617.1</li> </ul> </li> </ul> <h2>wrangler@4.102.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14340">#14340</a> <a href="https://github.com/cloudflare/workers-sdk/commit/f6e49dd59190328007331477450651e8bca2def8"><code>f6e49dd</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Add <code>cf-wrangler build</code> delegate support</p> <p>The experimental <code>cf-wrangler</code> delegate binary now accepts <code>build</code> and emits the Build Output API directory through Wrangler's new-config build path. This lets parent tools invoke Wrangler's build-output implementation with <code>cf-wrangler build</code> instead of shelling out through the public Wrangler CLI.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14324">#14324</a> <a href="https://github.com/cloudflare/workers-sdk/commit/36777dbd694acdf0a2d1fc2be322a47bd409e7fe"><code>36777db</code></a> Thanks <a href="https://github.com/jamesopstad"><code>@jamesopstad</code></a>! - Add experimental <code>--experimental-cf-build-output</code> flag to <code>wrangler build</code></p> <p>When used alongside <code>--experimental-new-config</code>, <code>wrangler build</code> now emits a self-contained Build Output API directory under <code>.cloudflare/output/v0/</code> instead of delegating to <code>wrangler deploy --dry-run</code>.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14347">#14347</a> <a href="https://github.com/cloudflare/workers-sdk/commit/673b09e0fa26368125fb527596a8eb5d31c27302"><code>673b09e</code></a> Thanks <a href="https://github.com/jamesopstad"><code>@jamesopstad</code></a>! - Update undici from 7.24.8 to 7.28.0</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14346">#14346</a> <a href="https://github.com/cloudflare/workers-sdk/commit/e930bd4ca9880eb0b68ce6d1933c1d9ce290317d"><code>e930bd4</code></a> Thanks <a href="https://github.com/haidargit"><code>@haidargit</code></a>! - Bump <code>ws</code> from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p</p> <p><a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">GHSA-96hv-2xvq-fx4p</a> / <a href="https://www.cve.org/CVERecord?id=CVE-2026-48779">CVE-2026-48779</a> (high severity) reports a remote memory-exhaustion DoS in <code>ws@<8.21.0</code>: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a <code>ws</code> server or client via OOM. The fix shipped in <a href="https://github.com/websockets/ws/releases/tag/8.21.0">ws@8.21.0</a> (commit <code>2b2abd45</code>, released 2026-05-22), which also introduces the <code>maxBufferedChunks</code> and <code>maxFragments</code> options. This change bumps the workspace catalog entry so that <code>miniflare</code>, <code>wrangler</code>, and <code>@cloudflare/vite-plugin</code> all pick up the patched release.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14314">#14314</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5c3bb118a99da70c5c1efb07df37f685e7044ba6"><code>5c3bb11</code></a> Thanks <a href="https://github.com/harryzcy"><code>@harryzcy</code></a>! - Bump esbuild to 0.28.1</p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/workers-sdk/commit/4d8ffcb00853c046e9b9263fef54a1d38d6c90c4"><code>4d8ffcb</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14353">#14353</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/764989568ecbfadd111fc399c83d71dd9ce6cf1b"><code>7649895</code></a> move auto provisioning to deploy-helpers (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14354">#14354</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/cfd6205fe86f6afd74b5881f09524c93c83b8359"><code>cfd6205</code></a> Extract autoconfig in its own standalone package (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14295">#14295</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/dd7e1011cb3680a26d2021473fbb2c91d03d6947"><code>dd7e101</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14327">#14327</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/5dfb788595a2104b4b0922cfce3d69a2f1d881eb"><code>5dfb788</code></a> Support dev.plugin on typed services bindings (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14269">#14269</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/296ad659305ee150d61451991f04a135fe99d264"><code>296ad65</code></a> Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/f6e49dd59190328007331477450651e8bca2def8"><code>f6e49dd</code></a> add build command to cf-wrangler (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14340">#14340</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/36777dbd694acdf0a2d1fc2be322a47bd409e7fe"><code>36777db</code></a> Wrangler support for experimental Build Output API (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14324">#14324</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/a79b899e284d46a8f0f9c4df113068ba66aaad0f"><code>a79b899</code></a> [wrangler] fix: respect find_additional_modules when no_bundle is set (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14315">#14315</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/5c3bb118a99da70c5c1efb07df37f685e7044ba6"><code>5c3bb11</code></a> Bump esbuild to 0.28.1 (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14314">#14314</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cloudflare/workers-sdk/commits/wrangler@4.103.0/packages/wrangler">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/harvard-edge/cs249r_book/network/alerts). </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-07-16 00:24:23 -05:00

GiteaMirror closed this issue

2026-07-16 00:24:26 -05:00

Sign in to join this conversation.

Branches Tags

dev

feat/mlperf-edu-precondition

gh-pages

vol1/all-final

main

vol1/appendices-final

vol1/ch16-final

vol1/ch15-final

vol1/ch14-final

vol1/ch13-final

vol1/ch11-final

vol1/ch12-final

vol1/ch10-final

vol1/ch9-final

vol1/ch8-final

vol1/ch7-final

vol1/ch6-final

vol1/ch5-final

vol1/ch4-final

vol1/ch3-final

vol1/ch2-final

vol1/frontmater-final

kai/fixing-profile-setting-and-map

chore/staffml-ci-path

fix/callout-flow

vol1/ch10-pass4

vol1/ch9-pass4

vol1/ch8-pass4

vol1/ch7-pass4

vol1/ch6-pass4

vol1/ch5-pass4

vol1/apC-pass3

vol1/ch4-pass4

vol1/ch3-pass4

vol1/ch2-pass4

vol1/ch1-pass4

vol1/frontmatter

vol1/apE-pass3

vol1/apD-pass3

fmt-fix

vol1/ch14-pass3

kai/clarify-community-map-totals

vol1/ch13-pass3

vol1/ch12-pass3

vol1/ch11-pass3

vol1/ch10-pass3

vol1/ch7-pass3

vol1/ch9-pass3

vol1/ch8-pass3

vol1/ch6-pass3

vol1/ch5-pass3

vol1/ch4-pass3

vol1/ch3-pass3

vol1/ch2-pass3

vol1/ch1-pass3

vol1/ch6-pass2

vol1/ch5-pass2

vol1/ch4-pass2

vol1/ch3-pass2

vol1/ch2-pass2

fix/badge-fixes

chore/precommit-cleanup

cleanup/book-validate-paths

fix/staffml-trigger-on-workflow-edits

fix/staffml-reusable-concurrency

feat/container-preflight-urls

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/cs249r_book#36509

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`