Skip to content

Repository navigation

fix: upgrade vulnerable dependencies and migrate worker tests #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sds merged 9 commits into from
Oct 21, 2026
+1,720 −1,405
Merged

fix: upgrade vulnerable dependencies and migrate worker tests #102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
78a36cf
fix: upgrade TanStack Start to prevent reflected XSS
grandizzy Oct 19, 2026
7353c83
fix: pin compatible dependencies past release cooldown
grandizzy Oct 19, 2026
d724a83
chore: rely on lockfile for transitive dependency versions
grandizzy Oct 19, 2026
69812a1
chore: sync security fixes with main
grandizzy Oct 21, 2026
39239a3
fix: upgrade Hono to prevent static middleware bypass
grandizzy Oct 21, 2026
b8af974
fix: upgrade vulnerable dependencies and migrate worker tests
grandizzy Oct 21, 2026
4b252dc
fix: retain mature dependency versions for CI policy
grandizzy Oct 21, 2026
6c96394
test: spy on fetch in the updated worker runtime
grandizzy Oct 21, 2026
b20782a
fix: allow workerd build for vitest plugin
decofe Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
0 ...hes/@tanstack__react-start@1.167.65.patch → ...hes/@tanstack__react-start@1.168.60.patch
View file
Open in desktop
File renamed without changes.
81 changes: 0 additions & 81 deletions config/patches/braces@3.0.3.patch
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion config/tsconfig.workers.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"../src/worker-configuration.d.ts",
"node",
"vite/client",
"@cloudflare/vitest-pool-workers/types",
"@cloudflare/vitest-plugin/types",
"vitest"
],
"tsBuildInfoFile": "../node_modules/.tmp/tsconfig.workers.tsbuildinfo"
Expand Down
2 changes: 1 addition & 1 deletion config/vitest.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import process from 'node:process'

// @cloudflare/vitest-pool-workers currently forwards these harmless dependency/runtime logs.
// @cloudflare/vitest-plugin currently forwards these harmless dependency/runtime logs.
const ignoredTestOutput = [
'[chat-sdk',
'disconnected: WebSocket peer disconnected',
Expand Down
10 changes: 5 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,12 @@
"@emoji-mart/data": "1.2.1",
"@hono/zod-validator": "^0.8.0",
"@tanstack/react-query": "^5.100.10",
"@tanstack/react-router": "1.169.2",
"@tanstack/react-start": "1.167.65",
"@tanstack/router-plugin": "1.167.35",
"@tanstack/react-router": "1.170.41",
"@tanstack/react-start": "1.168.60",
"@tanstack/router-plugin": "1.168.42",
"accounts": "^0.15.2",
"chat": "4.27.0",
"hono": "4.13.7",
"hono": "4.13.11",
"kysely": "0.28.17",
"nanoid": "^5.1.16",
"ox": "0.14.20",
Expand All @@ -50,7 +50,7 @@
},
"devDependencies": {
"@cloudflare/vite-plugin": "1.37.0",
"@cloudflare/vitest-pool-workers": "0.16.3",
"@cloudflare/vitest-plugin": "1.4.0",
Comment thread
claude[bot] marked this conversation as resolved.
Resolved
"@iconify/json": "2.2.467",
"@playwright/test": "1.59.1",
"@slack/web-api": "7.15.2",
Expand Down
Loading
Loading