This repository was archived by the owner on Sep 28, 2026. It is now read-only.
Repository navigation
docs(evidence): re-verify locked wrangler toolchain fix on current main (2026-08-12) #150
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| # Locked Wrangler toolchain: 4.103.0 → fixed release — re-verify 2026-08-12 | ||
|
|
||
| Date: 2026-08-12 | ||
| Scope: backlog item "[unreviewed-by-grok] Upgrade the locked Wrangler | ||
| toolchain from 4.103.0 to a fixed release — `npm audit` now reports [four | ||
| high-severity findings]" (scout 2026-08-09/11, risk: high). The finding was | ||
| fixed and merged as PR #101 (`37ddaed`, "fix(deps): upgrade locked wrangler | ||
| toolchain to 4.120.1 (npm audit: 4 high -> 0)", 2026-08-11), with a closeout | ||
| receipt at `docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md`. This | ||
| receipt re-verifies every acceptance criterion against the current head | ||
| (`ad9cee3`, 2026-08-12) and a fresh `npm ci`, because the item is still tagged | ||
| unreviewed-by-grok and origin/main has moved since the 2026-08-11 receipt. | ||
|
|
||
| ## What changed on main since the 2026-08-11 receipt | ||
|
|
||
| Commits between `37ddaed` and `ad9cee3` (2026-08-12): favicon/`rel=icon` | ||
| fixes (`9302611`, `18128e8`), intake-form label and document-title fixes | ||
| (`d4a2c30`), PR #29 closeout (`a0b83b0`), a ship-verify evidence commit | ||
| (`43c9e14`), an AI-search evidence commit (`8606b0c`), a CodeRabbit MD040 | ||
| doc fix (`62eec0a`), an AI-search ground-truth fix (`ed62202`), and merges of | ||
| PR #141 and #43. **None touch `package.json` or `package-lock.json`** (0 | ||
| commits in that path), so the toolchain lock is byte-identical to the | ||
| 2026-08-11 fix. This is a source/offline check plus a local dry-run bundle | ||
| check, not a live-deployment measurement (nothing in the dependency change | ||
| touches served bytes). | ||
|
Comment on lines
+23
to
+25
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: printf '%s\n' '--- candidate plan files ---'
find . -maxdepth 3 -type f \( -iname '*plan*' -o -iname 'PLAN*' \) -print
printf '%s\n' '--- repository status ---'
git status --short
printf '%s\n' '--- target file ---'
sed -n '1,90p' docs/evidence/wrangler-toolchain-audit-fix-reverify-2026-08-12.mdRepository: nish3451/TinyStudio.io Length of output: 4194 🏁 Script executed: printf '%s\n' '--- plan references to Wrangler/toolchain/audit ---'
rg -n -i 'wrangler|toolchain|npm audit|dry-run|served bytes|bundle' specs docs/plans .specify 2>/dev/null || true
printf '%s\n' '--- target lines 50-68 ---'
sed -n '50,68p' docs/evidence/wrangler-toolchain-audit-fix-reverify-2026-08-12.md
printf '%s\n' '--- related evidence files ---'
find docs/evidence -maxdepth 1 -type f -iname '*wrangler*' -printRepository: nish3451/TinyStudio.io Length of output: 3254 🏁 Script executed: printf '%s\n' '--- changes after the dependency fix ---'
git diff --name-status 37ddaed ad9cee3
printf '%s\n' '--- dependency-fix commit paths ---'
git show --format=fuller --name-status --no-renames 37ddaed | sed -n '1,100p'
printf '%s\n' '--- prior receipt ---'
sed -n '1,120p' docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md
printf '%s\n' '--- deployment configuration and scripts ---'
find . -maxdepth 2 -type f \( -name 'wrangler.jsonc' -o -name 'wrangler.toml' -o -name 'package.json' \) -printRepository: nish3451/TinyStudio.io Length of output: 6429 🏁 Script executed: python3 - <<'PY'
from pathlib import Path
import subprocess
target = Path("docs/evidence/wrangler-toolchain-audit-fix-reverify-2026-08-12.md")
for i, line in enumerate(target.read_text().splitlines(), 1):
if 20 <= i <= 65:
print(f"{i}: {line}")
print("\n--- current-head paths changed after dependency fix ---")
paths = subprocess.check_output(
["git", "diff", "--name-only", "37ddaed", "ad9cee3e"], text=True
).splitlines()
for p in paths:
print(p)
print("\n--- hash/digest comparison terms in related evidence ---")
for p in [
"docs/evidence/wrangler-toolchain-audit-fix-2026-08-11.md",
"docs/evidence/wrangler-toolchain-audit-fix-reverify-2026-08-12.md",
]:
text = Path(p).read_text().splitlines()
hits = [
f"{i}: {line}" for i, line in enumerate(text, 1)
if any(term in line.lower() for term in ("hash", "digest", "sha256", "byte-identical", "byte equivalence"))
]
print(p)
print("\n".join(hits) if hits else "(no matching comparison term)")
PYRepository: nish3451/TinyStudio.io Length of output: 3550 Scope the served-byte statement. Lines 23–25 and 58–63 should state that the dependency-fix commit changed only package manifests and the lockfile. The current head also changes 🤖 Prompt for AI Agents |
||
|
|
||
| ## Acceptance criteria — current head `ad9cee3`, fresh `npm ci` | ||
|
|
||
| 1. The lockfile pins `wrangler` at a release ≥ the first fixed release, with | ||
| the vulnerable `sharp` and `undici` chains out of range. | ||
| - `package.json`: `"wrangler": "^4.120.1"` (range floor raised from | ||
| `^4.93.0` so future installs cannot resolve below the fixed range). | ||
| - `package-lock.json`: `wrangler@4.120.1` → `miniflare@5.20260804.0-alpha` | ||
| → `sharp@0.35.2` (≥ 0.35.0, fixes GHSA-f88m-g3jw-g9cj) and | ||
| `undici@7.29.0` (> 7.28.0, fixes GHSA-8xcm-r25x-g524 and four more). | ||
| 2. `npm audit` reports zero vulnerabilities on a fresh install from the | ||
| lockfile (was 4 high at 4.103.0). | ||
| 3. The full `npm test` gate chain passes under the locked toolchain. | ||
| 4. The worker bundles cleanly: `wrangler deploy --dry-run` passes. | ||
|
|
||
| ## Results (2026-08-12, fresh `npm ci` on this head) | ||
|
|
||
| 1. `npm ci` — installs cleanly from the lockfile, `found 0 vulnerabilities`. | ||
| 2. `npm audit` — `found 0 vulnerabilities` (was 4 high). | ||
| 3. `npm ls wrangler miniflare sharp undici` — `wrangler@4.120.1`, | ||
| `miniflare@5.20260804.0-alpha`, `sharp@0.35.2`, `undici@7.29.0`, all | ||
| deduped under wrangler, no extraneous or missing packages. | ||
| 4. `npm test` — exit 0: `npm run check` ("TinyStudio.io checks passed."), | ||
| heading-hierarchy 6/6, sitemap 7/7, agent-worker 55/55, agent-UI 16/16, | ||
| product-contract 8/8 — 92/92 green. | ||
| 5. `node_modules/.bin/wrangler deploy --dry-run` — `⛅️ wrangler 4.120.1`, | ||
| reads 30 files from `public/`, total upload 54.37 KiB / gzip 15.15 KiB, | ||
| binds `DB` (D1), `AI` and `ASSETS` resolved, `--dry-run: exiting now.`, | ||
| exit 0. The bundle builds under the locked 4.120.1. | ||
|
|
||
| ## Conclusion | ||
|
|
||
| The item's acceptance criteria are met on current main: the lockfile pins the | ||
| fixed chain `wrangler 4.120.1` → `miniflare 5.20260804.0-alpha` → `sharp | ||
| 0.35.2` / `undici 7.29.0` and has not drifted since PR #101 merged, | ||
| `npm audit` reports zero vulnerabilities from a fresh `npm ci`, the full test | ||
| gate chain (92/92) passes, and the worker bundles cleanly under the upgraded | ||
| toolchain. Nothing further to change; the item can be ticked. | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This receipt claims to verify the current head at
ad9cee3, but the reviewed commit is based directly on the newerfe4d2ae, which landed afterward. Consequently the stated commit range and “current main” verification omitfe4d2ae; for an evidence artifact whose purpose is to prove the gates against the latest main, either rerun/record the checks againstfe4d2aeor explicitly document and verify that intervening commit.Useful? React with 👍 / 👎.