Repository navigation
fix(deps): Bump Cloudflare toolchain and pin zod to patched release - #1912
Conversation
Semgrep flags zod usages under GHSA-mrhx-c7xc-m3w5 because the lockfile still carried zod@3.22.3 (miniflare via @cloudflare/vite-plugin@1.13.15, which mcp-cloudflare pinned below the catalog) and zod@4.6.5 (@cloudflare/vitest-plugin@1.4.6 plus ranged deps locked to it). - mcp-cloudflare now takes @cloudflare/vite-plugin from the catalog - Catalog moves to a consistent Cloudflare set: vite-plugin 1.66.0, vitest-plugin 1.4.9, wrangler 4.154.0, miniflare 5.20261023.1-beta - Override zod to ^4.6.6 so every copy stays on a patched release The lockfile now resolves a single zod@4.6.7. Co-Authored-By: David Cramer <23610+dcramer@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Semgrep found 6
🟠 High severity issue identified in your code: Risk: Affected versions of @cloudflare/workerd-darwin-64, @cloudflare/workerd-darwin-arm64, @cloudflare/workerd-linux-64, @cloudflare/workerd-linux-arm64, @cloudflare/workerd-windows-64, @duckdb/node-api, @duckdb/node-bindings, @duckdb/node-bindings-darwin-arm64, @duckdb/node-bindings-darwin-x64, @duckdb/node-bindings-linux-arm64, @duckdb/node-bindings-linux-arm64-musl, @duckdb/node-bindings-linux-x64, @duckdb/node-bindings-linux-x64-musl, @duckdb/node-bindings-win32-arm64, @duckdb/node-bindings-win32-x64, @napi-rs/canvas, @napi-rs/canvas-linux-arm64-gnu, @napi-rs/canvas-linux-x64-gnu, @napi-rs/canvas-linux-x64-musl, @oven/bun-darwin-aarch64, @oven/bun-darwin-x64, @oven/bun-darwin-x64-baseline, @oven/bun-freebsd-aarch64, @oven/bun-freebsd-x64, @oven/bun-linux-aarch64, @oven/bun-linux-aarch64-android, @oven/bun-linux-aarch64-musl, @oven/bun-linux-x64, @oven/bun-linux-x64-android, @oven/bun-linux-x64-baseline, @oven/bun-linux-x64-musl, @oven/bun-linux-x64-musl-baseline, @oven/bun-windows-aarch64, @oven/bun-windows-x64, @oven/bun-windows-x64-baseline, @skia-canvas/linux-arm64-glibc, @skia-canvas/linux-arm64-musl, @skia-canvas/linux-x64-glibc, @skia-canvas/linux-x64-musl, @sparticuz/chromium, @yao-pkg/pkg-fetch, @zkl2333/freetype-wasm, canvaskit-wasm, chrome-aws-lambda, duckdb, electron, electron-nightly, fonteditor-core, iltorb, kuzu, kuzu-wasm, lbug, node-aix-ppc64, node-darwin-x64, node-libcurl, node-linux-arm64, node-linux-armv7l, node-linux-ppc64le, node-linux-s390x, node-linux-x64, node-sunos-x64, node-win-arm64, node-win-x64, node-win-x86, nodejs-mobile-react-native, pkg-fetch, playwright-chromium, playwright-core, puppeteer, skia-canvas, wawoff2, woff2-encoder, and workerd are vulnerable to Out-of-bounds Write. These packages use a version of the Brotli C library (1.0.3 through 1.2.0) that has an out-of-bounds write in the Brotli decoder. Decoding attacker-controlled Brotli data (for example HTTP responses, request bodies, WOFF2 fonts or Parquet files) can corrupt memory and may lead to denial of service, memory disclosure or remote code execution. Upgrade to a fixed version where one is available. Fix: Upgrade this library to at least version 1.20261027.1 at toolkit/pnpm-lock.yaml:9340. Reference(s): https://github.com/advisories/GHSA-cust-0000-0034 |
Semgrep flags workerd 1.20261023.1 (Brotli decoder out-of-bounds write, GHSA-cust-0000-0034; fixed in workerd >= 1.20261027.1). The first Cloudflare releases on a fixed workerd are the Nov 1 set, so move the toolchain together: vite-plugin 1.67.0, vitest-plugin 1.4.12, wrangler 4.156.1 and miniflare 5.20261101.0-beta (workerd 1.20261101.1).
|
Addressed in b38a862. No Cloudflare release before Nov 1 depends on a patched workerd (>= 1.20261027.1). Wrangler 4.154–4.156.0 all pin 1.20261023.1. So the toolchain now moves together to the Nov 1 set: Locally: frozen install, |
Semgrep keeps flagging zod usage (GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404) on any PR that touches zod schemas, e.g. #1861. The code we ship already resolves a patched
zod@4.6.7. The flagged copies come only from stale Cloudflare dev tooling inmcp-cloudflare:@cloudflare/vitest-plugin@1.4.6pinszod@4.6.5exactly.miniflare@4.20251011.1pinszod@3.22.3(no patched 3.x exists). It comes in through@cloudflare/vite-plugin@1.13.15, whichmcp-cloudflarepinned locally below the catalog's^1.31.0.Changes
packages/mcp-cloudflaretakes@cloudflare/vite-pluginfromcatalog:instead of its own^1.13.15pin.@cloudflare/vite-plugin1.66.0,@cloudflare/vitest-pool-workers/vitest-plugin 1.4.9,wrangler4.154.0,miniflare5.20261023.1-beta. These are about a week old; I skipped the Nov 1 releases.minimumReleaseAgeExcludeentries are updated to match.zod: ^4.6.6keeps every copy on a patched release.Result: the lockfile resolves a single
zod@4.6.7.Verification
Locally:
pnpm install --frozen-lockfile,pnpm run tsc,pnpm run lint,pnpm run build, and themcp-cloudflaretests (447 passed). Peer dependency warnings went down.Not tested:
wrangler devor a deploy on the new wrangler/miniflare. Worth a look before merging since this is the tooling that builds and deploys the hosted MCP server.Related: #1861
Co-Authored-By: David Cramer dcramer@users.noreply.github.com
via @dcramer.
--
View Session [Sentry]