fix(deps): upgrade locked wrangler toolchain to 4.120.1 (npm audit: 4 high -> 0) by nish3451 · Pull Request #101 · Nishfleet/TinyStudio.io

nish3451 · 2026-08-11T03:21:35Z

What

The lockfile pinned wrangler 4.103.0, whose miniflare 4.20260617.1 chain pulled vulnerable sharp <0.35.0 (GHSA-f88m-g3jw-g9cj, libvips CVEs CVE-2026-33327/33328/35590/35591) and undici 7.0.0-7.28.0 (GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272, GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm) — four high-severity npm audit findings.

package.json: wrangler ^4.93.0 → ^4.120.1 (range floor raised to the first fixed release so the lock cannot resolve back below it).
package-lock.json regenerated: wrangler 4.120.1 → miniflare 5.20260804.0-alpha → sharp 0.35.2, undici 7.29.0. No other dependency changed; no served bytes change (build-toolchain only).
docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md: closeout receipt.

Verification

npm audit: 0 vulnerabilities (was 4 high).
npm test: all suites green (exit 0), including npm run check.
npm run check:render-blocking: all six pages pass in real Chromium.
wrangler deploy --dry-run (4.120.1): bundles cleanly, 30 assets, binds DB/AI/ASSETS.

Closes the unreviewed-by-grok review item "Upgrade the locked Wrangler toolchain from 4.103.0 to a fixed release — npm audit now reports [4 high]".

Summary by CodeRabbit

Chores
- Updated the Wrangler development tooling to version 4.120.1.
- Refreshed dependency lockfile entries to address reported security vulnerabilities.
Documentation
- Added an audit record documenting the upgrade, verification results, and successful test and dry-run checks.

…audit findings wrangler 4.103.0 pulled miniflare -> sharp <0.35.0 (GHSA-f88m-g3jw-g9cj, libvips CVEs) and undici 7.0.0-7.28.0 (GHSA-8xcm-r25x-g524 and four more). 4.120.1 ships miniflare 5.20260804.0-alpha with sharp 0.35.2 and undici 7.29.0. npm audit is now clean.

…current main (#PR)

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

coderabbitai · 2026-08-11T03:21:47Z

📝 Walkthrough

Walkthrough

Wrangler was upgraded from ^4.93.0 to ^4.120.1. The PR adds an audit-fix receipt that records affected dependencies, verification results, environment limitations, and closeout status.

Changes

Wrangler audit fix

Layer / File(s)	Summary
Wrangler toolchain update `package.json`, `docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md`	The Wrangler development dependency now uses `^4.120.1`. The audit scope and affected dependency chain are recorded.
Audit verification and closeout `docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md`	The receipt records zero audit findings, passing tests and checks, dry-run bundling results, environment limitations, and closeout details.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

nish3451/0509#501: Updates the wrangler dependency in package.json to a different target version.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the Wrangler upgrade and its purpose of resolving the npm audit findings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch upgrade-wrangler-toolchain

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md`:
- Around line 60-65: Remove the developer-specific /home/nish/package.json
reference from the note and replace it with a neutral, non-identifying
placeholder while preserving the surrounding explanation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0edcb2c6-6726-4973-a3b5-ad03009118e1

📥 Commits

Reviewing files that changed from the base of the PR and between 5ab84ea and ee24a6f.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md
package.json

coderabbitai · 2026-08-11T04:10:24Z

+   (One local-environment note: this machine has a stray empty
+   `/home/nish/package.json` outside the repo that breaks Node tooling which
+   walks three directory levels up from a worktree; the dry-run was
+   re-verified with that file moved aside and in a same-depth copy under
+   `/tmp`, and passes in both. The self-hosted CI runner checks out under
+   `/var/lib/github-runners/verify*/_work/…`, where no such file exists.)


🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove the developer-specific absolute path.

The receipt commits /home/nish/package.json, which exposes a local username and filesystem detail. Replace it with a neutral placeholder before committing the receipt.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md` around lines 60 - 65, Remove the developer-specific /home/nish/package.json reference from the note and replace it with a neutral, non-identifying placeholder while preserving the surrounding explanation.

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab0db5ad5c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-11T06:37:44Z

+wrangler-bundled Worker, so this PR changes no served bytes. CI runs the same
+gates (`npm ci`, `npm test`, Chromium render-blocking check,
+`wrangler deploy --dry-run`) against this PR before merge.


Verify the bundle with the locked Wrangler

When the npm latest tag advances beyond 4.120.1, this statement no longer describes the CI gate: the inspected .github/workflows/ci.yml bundle step runs npx wrangler@latest deploy --dry-run, so it can validate a remotely fetched newer release rather than the version pinned by this PR. The local npx --help explicitly accepts <pkg>[@<version>] from a local or remote package, making the @latest override intentional; use the existing npm run deploy:dry-run script (or unversioned local binary) so CI actually verifies the locked toolchain documented here.

Useful? React with 👍 / 👎.

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

greptile-apps

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

nish3451 added 2 commits August 11, 2026 08:47

docs(evidence): close out the locked-wrangler audit-fix item against …

9bdf6f9

…current main (#PR)

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

Merge branch 'main' into upgrade-wrangler-toolchain

ee24a6f

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

coderabbitai Bot reviewed Aug 11, 2026

View reviewed changes

Merge branch 'main' into upgrade-wrangler-toolchain

ab0db5a

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Aug 11, 2026

View reviewed changes

Merge branch 'main' into upgrade-wrangler-toolchain

f8b73b5

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

Merge branch 'main' into upgrade-wrangler-toolchain

b692153

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

Merge branch 'main' into upgrade-wrangler-toolchain

3f04162

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

Merge branch 'main' into upgrade-wrangler-toolchain

e9828ea

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

Merge branch 'main' into upgrade-wrangler-toolchain

b6ebbf9

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

nish3451 merged commit 37ddaed into main Aug 11, 2026
3 checks passed

nish3451 mentioned this pull request Aug 12, 2026

docs(evidence): re-verify locked wrangler toolchain fix on current main (2026-08-12) #150

Merged

Uh oh!

Conversation

nish3451 commented Aug 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Verification

Summary by CodeRabbit

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

nish3451 commented Aug 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading