[sadrbot]

What this PR does

Sadr fixed six Semgrep supply-chain findings for the Brotli out-of-bounds write in workerd, with an npm override to workerd 1.20261101.1. It moved Node to 26.13.0, the first LTS release of Node 26, and moved wrangler, @cloudflare/vitest-plugin, @cloudflare/workers-types and the Semgrep CI image to their newest releases past the 7-day cooldown.

Changes

• Runtime: Node 24.22.1 → 26.13.0, npm 11.19.1 → 11.20.0 (.github/workflows/ci.yml, .github/workflows/cf-fallback.yml)
• Dependencies: wrangler 4.152.0 → 4.156.0 (package.json, package-lock.json)
• Dependencies: @cloudflare/vitest-plugin 1.4.7 → 1.4.11 (package.json, package-lock.json)
• Dependencies: @cloudflare/workers-types 5.20261025.1 → 5.20261101.1 (package.json, package-lock.json)
• Dependencies, through the regenerated lockfile: miniflare 5.20261019.2-beta → 5.20261023.3-beta (pinned exactly by wrangler), rolldown and its platform packages 1.2.15 → 1.2.16, @oxc-project/types 0.155.0 → 0.156.0, magic-string 1.4.3 → 1.4.5, postcss 8.5.31 → 8.5.32, tslib 2.8.1 → 2.9.1, @types/estree 1.0.9 → 1.0.10
• Security: workerd and its five platform packages 1.20261019.1 → 1.20261101.1, through a new workerd entry in the package.json overrides. wrangler 4.156.0 and miniflare 5.20261023.3-beta pin workerd 1.20261023.1 exactly, which still has the flaw, and no newer wrangler is past the cooldown yet.
• CI: Semgrep image 1.182.0 → 1.183.0, pinned by digest (.github/workflows/semgrep.yml)

Supply chain

• cooldown: unchanged, npm min-release-age=7 (.npmrc). All 172 entries of the regenerated package-lock.json are at least 7 days old.
• pins: semgrep/semgrep:1.183.0@sha256:2e45517a85e1… (built 2026-10-29T18:33Z). actions/checkout v7.0.1 and actions/setup-node v7.1.0 are unchanged and already the newest past the cooldown. Node 26.13.0 (released 2026-10-28) is pinned exactly in both setup-node steps.
• cooldown exceptions: none
• inside the cooldown (already merged): none
• waiting for cooldown: wrangler 4.158.0 (clears 2026-11-12T10:45Z), @cloudflare/vitest-plugin 1.6.0 (clears 2026-11-12T10:49Z), @cloudflare/workers-types 5.20261108.1 (clears 2026-11-15T01:04Z), vitest 5.1.0 (clears 2026-11-09T16:12Z), semgrep/semgrep 1.184.0 (clears 2026-11-12T18:52Z)

Security findings

• untriaged: 6 → 0 (Semgrep API and semgrep ci --dry-run)
• open: 6 → 0 (the dry run on this branch finds 0. The platform closes the 6 after the first scan of main with this PR merged.)
• fixed: 6 (workerd 1.20261019.1 → 1.20261101.1 through an npm override: Semgrep GHSA-cust-0000-0034, Brotli 1.0.3–1.2.0 out-of-bounds write, CWE-787, ids 1058526119, 1058526120, 1058526121, 1058526122, 1058526123, 1058526124)
• false positive: 0
• accepted risk: 0
• other: 0
• suppressions reviewed: 0

Holds

• kept: the repo's own undici ^7.30.1 and zod ^4.6.7 overrides in package.json. @cloudflare/vitest-plugin 1.4.11 still pins zod 4.6.6. miniflare 5.20261023.3-beta now pins undici 7.30.1 itself.
• added: none. The new workerd override is a security fix at a release past the cooldown, not a cooldown cap. A later run can drop it once wrangler pins workerd 1.20261027.1 or later.
• honored: none

AGENTS.md

• ### Toolchain: CI and the fallback deploy now pin Node 26.13.0 (npm 11.20.0). The facts PR sadr: AGENTS.md facts 2026-11-08 #10 replaces the Node 24.22.1 line.

Merging

• auto-merge: all (owner Settings in pid1/.github, upkeep PRs)
• turned on auto-merge (merge)

Needs you

• Set a 7-day npm release cooldown in the Cloudflare Workers Builds settings for scram, if it is not set yet. Workers Builds ships its own npm and ignores .npmrc.

Verification

• npm ci on Node 26.13.0 (npm 11.20.0): passed, on main and after each step
• npm ci, npm run typecheck and npm test on Node 24.22.2 on main before any change: passed, 4 files, 38 tests
• npm run typecheck: passed after each step
• npm test: 4 files, 38 tests passed after each step
• workerd --version from node_modules: 2026-11-01 (1.20261101.1)
• npx --no-install wrangler dev --port 18797: GET / returned 200, GET /api/status returned 401 without the admin token, GET /.build-id returned 200
• npm outdated on npm 11.20.0: no direct dependency has a newer release past the cooldown
• lockage.py --min-age-days 7 package-lock.json: 172 entries dated, 0 younger than 7 days, 0 undated
• semgrep ci --dry-run on main: 6 supply-chain findings (workerd and its platform packages). On this branch: 0 findings, 172 dependencies parsed from package-lock.json
• OSV query for Node 26.13.0: no advisories
• pins.py check on the three workflows: 8 pins checked, no problems
• gitleaks git on the branch commits and on the full history of main: no leaks

Run

• 10 minutes, US$2.14

Not done or not checked

• Sadr did not run scripts/setup.sh, npm run deploy or npm run db:migrate. They write to the Cloudflare account.
• Sadr did not run the Semgrep 1.183.0 container itself. The semgrep/ci check on this PR runs it.
• The npm override runs wrangler 4.156.0 and miniflare 5.20261023.3-beta with workerd 1.20261101.1 instead of the 1.20261023.1 they pin. The tests and wrangler dev pass with it. Cloudflare's production runtime does not use this package.

---

Opened by Sadr, a dark factory for software.