[sadrbot]

What this PR does

Sadr moved wrangler, vitest and the Cloudflare development packages to their newest releases past the 7-day cooldown, and moved the Semgrep CI image to 1.184.0. wrangler 4.158.0 now pins a workerd release that holds the Brotli fix, so Sadr removed the workerd override that the last upkeep PR added.

Changes

• dependencies: wrangler 4.156.0 → 4.158.0
• dependencies: vitest 5.0.5 → 5.1.0
• dependencies: @cloudflare/vitest-plugin 1.4.11 → 1.6.0
• dependencies: @cloudflare/workers-types 5.20261101.1 → 5.20261108.1
• dependencies: workerd 1.20261101.1 → 1.20261104.1, now the version that wrangler and miniflare pin. Sadr removed the workerd override from package.json.
• dependencies: package-lock.json regenerated. Transitive moves: miniflare 5.20261023.3-beta → 5.20261104.0-beta, undici 7.30.1 → 7.30.2, vite 8.3.5 → 8.3.6, semver 7.8.5 → 7.8.6, tinybench 6.2.2 → 6.2.3.
• CI: Semgrep image 1.183.0 → 1.184.0, pinned by digest (.github/workflows/semgrep.yml)

Supply chain

• cooldown: unchanged (npm min-release-age=7 in .npmrc)
• pins: semgrep/semgrep:1.184.0@sha256:cc1b68266f26… (built 2026-11-05T18:52Z). actions/checkout v7.0.1 and actions/setup-node v7.1.0 are unchanged and already the newest past the cooldown.
• cooldown exceptions: none
• inside the cooldown (already merged): none
• waiting for cooldown: Node 26.13.1 (clears 2026-11-18T16:44Z), semgrep/semgrep 1.185.0 (clears 2026-11-17T09:04Z), wrangler 4.162.0 (clears 2026-11-20T17:04Z), @cloudflare/vitest-plugin 1.8.2 (clears 2026-11-20T17:09Z), @cloudflare/workers-types 5.20261115.1 (clears 2026-11-22T01:03Z)

Security findings

• untriaged: 0 → 0 (Semgrep API and semgrep ci --dry-run)
• open: 0 → 0
• fixed: 0
• false positive: 0
• accepted risk: 0
• other: 0
• suppressions reviewed: 0

Holds

• None.

AGENTS.md

• None.

Merging

• auto-merge: all (owner Settings in pid1/.github, upkeep PRs)
• turned on auto-merge (merge)

Needs you

• Set a 7-day npm release cooldown in the Cloudflare Workers Builds settings for scram, if it is not set yet. Workers Builds ships its own npm and ignores .npmrc.

Verification

• npm ci on Node 26.13.0 (npm 11.20.0): passed, on main and after each step
• npm run typecheck: passed, on main and after each step
• npm test: 4 files, 38 tests passed, on main and after each step
• npx --no-install wrangler dev --port 8791 against local D1: GET / returned 200, GET /api/status returned 401 without the admin token
• npm outdated on npm 11.20.0, after the update: no direct dependency has a newer release past the cooldown
• lockage.py --min-age-days 7 package-lock.json: 172 entries dated, 0 younger than 7 days, 0 undated, on main and on this branch
• OSV queries for workerd 1.20261104.1, undici 7.30.2, zod 4.6.7, wrangler 4.158.0, vitest 5.1.0 and miniflare 5.20261104.0-beta: no advisories
• semgrep ci --dry-run on main and on this branch: 0 findings, 172 dependencies parsed from package-lock.json
• pins.py check on the three workflows: 8 pins checked, no problems
• gitleaks git on the branch commits and on the full history of main: no leaks

Run

• 8 minutes, US$2.07

Not done or not checked

• Sadr did not run scripts/setup.sh, npm run deploy or npm run db:migrate. They write to the Cloudflare account.
• Sadr did not run the Semgrep 1.184.0 container itself. The semgrep/ci check on this PR runs it.
• CI stays on Node 26.13.0. Node 26.13.1 is a security release from 2026-11-11 that fixes CVEs in the Node TLS, HTTP/2 and HTTP servers. CI runs no Node server, so Sadr waits for the cooldown and takes 26.13.1 in a later run.

---

Opened by Sadr, a dark factory for software.