build(deps): refresh compatible dependencies and patch Undici

[steipete]

What Problem This Solves

Dependabot cannot apply the Undici security updates because Miniflare pins vulnerable Undici 7.29.0. This refreshes compatible dependencies and repairs that resolution, alongside the existing Sharp/libheif security fix.

User Impact

Development and deployment tooling use patched Undici 7.29.1/8.10.2 and Sharp 0.35.4. The declared Node >=22.22.0 floor, React 18/19 SDK peer contract, application and SDK versions, and database schema stay unchanged.

Why This Change Was Made

Add bounded Undici overrides alongside the existing security overrides, and refresh compatible runtime, build/test, and SHA-pinned Actions dependencies. This includes pnpm 11.28.0, Hono 4.13.9, React Query 5.104.0, Vite 8.3.1, Wrangler 4.142.0, and Cloudflare's Vitest plugin 1.3.0. Both dependency resolvers retain the two-day release cooldown.

Consolidates #106, #112, and #113. Better Auth stays at 1.6.33 with a matching schema generator; its 1.7 identity/schema changes remain deferred. jsdom 30 raises the Node floor, Vitest 5 conflicts with the Cloudflare plugin's Vitest 4 peers, and keyring 2 needs native credential-store upgrade proof. Those major bumps remain outside this change.

Evidence

The failing Dependabot run reports security_update_not_possible: latest resolvable Undici 7.29.0, earliest fixed 7.29.1 (run). The regenerated lockfile now resolves patched Undici versions in both major lines, and the audit reports no known vulnerabilities.

The final AWS Crabbox gate passed on Node 24.19.0 and pnpm 11.28.0: frozen install, lint, typecheck, all 252 tests (6 script, 37 core, 33 React, 48 CLI, 128 Worker), dashboard/demo/CLI builds, docs build, and packed SDK runtime/type entry-point verification. Auth-schema regeneration was byte-for-byte unchanged, and the Worker deployment dry run passed. Local actionlint also passed.

Lint retains 14 warnings in unchanged dashboard CSS, and the Worker tests print non-failing diagnostics from the synthetic webhook fixture. No assertions or checks were weakened, and no live deployment or release was performed.

Independent Codex review completed through P2 with no accepted findings. Its one cooldown finding was rejected against npm's publication timestamp: Workers Types 5.20260928.1 was published at 2026-09-28 01:30 UTC and verified at 2026-09-30 04:38 UTC, over 51 hours later. Frozen installs also passed pnpm's 48-hour policy checks.

The required code-owner approval is still pending; this PR is not merged.

Exact-head verification for 2fc418edb3e3d0e5f9e6138505e93abb094ae8fe: CI passed and CodeQL passed. All required checks are green; no CI rerun was needed. @vincentkoc and the maintainer/security owner teams have been requested for the required review.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 30, 2026, 12:50 AM ET / 04:50 UTC (Revision 20).

ClawSweeper review

What this changes

Updates workspace dependencies and pinned GitHub Actions, with pnpm overrides that resolve patched Undici and Sharp versions for Krillswitch’s builds and tooling.

Merge readiness

⛔ Blocked before merge - 3 items remain

Current main still locks the older Undici and Sharp versions, while this PR resolves the patched versions. The overlapping Dependabot PRs closed unmerged, so this remains the viable patch. No concrete correctness or supply-chain defect was found; required code-owner approval is pending.

Priority: P2
Reviewed head: 2fc418edb3e3d0e5f9e6138505e93abb094ae8fe
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The focused resolution changes, exact-head checks, and verified action pins support a good review rating; event-specific workflow approval remains outstanding.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (linked_artifact): The changed pnpm resolution feeds the Worker, dashboard, CLI, and SDK builds. The PR reports an after-fix AWS Crabbox frozen install, 252 tests, and a Worker dry run; exact-head CI independently completes frozen installs and its checks, while the lockfile shows patched Undici and Sharp. No stored schema file or contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The changed pnpm resolution feeds the Worker, dashboard, CLI, and SDK builds. The PR reports an after-fix AWS Crabbox frozen install, 252 tests, and a Worker dry run; exact-head CI independently completes frozen installs and its checks, while the lockfile shows patched Undici and Sharp. No stored schema file or contract changes.
Evidence reviewed	9 items	Current-main resolution: The main-branch lockfile resolves Undici 7.29.0 and 8.10.0 and Sharp 0.35.2; main has no Undici override. Proposed security resolution: The introduced overrides bound Undici updates within major versions 7 and 8 and raise the Sharp floor. Resolved patched versions: The proposed lockfile resolves Undici 7.29.1 and 8.10.2 and Sharp 0.35.4; the Worker test configuration uses Cloudflare’s Vitest plugin, establishing the tooling dependency path.
Findings	None	None.
Security	None	None.

How this fits together

Workspace manifests and pnpm choose dependencies for the Worker, dashboard, CLI, and SDK builds. CI and release workflows install that lockfile, then test, build, scan, deploy, or publish the resulting artifacts.

flowchart LR
A[Workspace manifests] --> B[pnpm overrides]
B --> C[Resolved lockfile]
C --> D[Worker and dashboard builds]
C --> E[SDK and CLI builds]
F[Pinned GitHub Actions] --> G[CI and release jobs]
D --> G
E --> G

Loading

Decision needed

Question	Recommendation
Do code owners accept the verified action-pin updates for SDK publishing and Pages deployment without an event-specific rehearsal on this PR?	Approve the pins: Accept the event-specific first-run risk after reviewing the official pins and monitor the next Pages and SDK release jobs.

Why: The new pins match official tags, but PR CI cannot execute the tag-only release or Pages deployment effects, and code-owner approval is pending.

Before merge

• Resolve merge risk (P1) - PR CI does not execute the updated tag-only SDK release or Pages deployment steps. Their official action pins are verified, but the first operator run still needs code-owner acceptance and monitoring.
• Complete next step (P2) - Obtain code-owner approval for the workflow pin updates and their event-specific first-run risk before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Lockfile changes	734 added, 726 removed	Most of the diff is dependency resolution churn rather than application source.
Action pins	4 updated across 3 workflows	CodeQL, SDK publishing, and Pages deployment each consume updated pinned actions.

Root-cause cluster

Relationship: canonical
Canonical: #87
Summary: This PR consolidates compatible dependency and Action updates from three closed, unmerged Dependabot PRs.

Members:

• superseded: chore(deps): bump the actions group with 4 updates #106 - Its Action updates are included here; it closed unmerged.
• partial_overlap: chore(deps): bump the production group across 1 directory with 11 updates #112 - Its production dependency refresh overlaps this PR, while major auth changes remain deferred.
• partial_overlap: chore(deps-dev): bump the development group across 1 directory with 10 updates #113 - Its development dependency refresh overlaps this PR, while incompatible major updates remain deferred.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Accept the verified pins (recommended)
   Code owners can approve the official action SHAs and monitor the first SDK release and Pages deployment runs.
2. Pause for a rehearsal
   Keep this PR open until the event-specific workflows have safe, observable rehearsal results.

Technical review

Best possible solution:

Keep the major-bounded Undici overrides until upstream exact pins advance, retain the matched auth generator, and verify the first Pages and SDK release runs after approval.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a dependency update. Current main’s lockfile and the failed Dependabot run establish why the patched resolution is needed.

Is this the best way to solve the issue?

Yes. The bounded overrides repair the vulnerable transitive resolutions while retaining the declared Node floor and aligning the auth schema generator with its runtime dependency.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4e172a04b056.

Labels

Label changes:

• add merge-risk: 🚨 automation: The SDK release and Pages deployment pins change event-specific automation that exact-head PR CI does not execute.

Label justifications:

• P2: The PR addresses vulnerable tooling resolutions and routine dependency maintenance with limited immediate user impact.
• merge-risk: 🚨 automation: The SDK release and Pages deployment pins change event-specific automation that exact-head PR CI does not execute.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The changed pnpm resolution feeds the Worker, dashboard, CLI, and SDK builds. The PR reports an after-fix AWS Crabbox frozen install, 252 tests, and a Worker dry run; exact-head CI independently completes frozen installs and its checks, while the lockfile shows patched Undici and Sharp. No stored schema file or contract changes.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed pnpm resolution feeds the Worker, dashboard, CLI, and SDK builds. The PR reports an after-fix AWS Crabbox frozen install, 252 tests, and a Worker dry run; exact-head CI independently completes frozen installs and its checks, while the lockfile shows patched Undici and Sharp. No stored schema file or contract changes.

Evidence

What I checked:

• Current-main resolution: The main-branch lockfile resolves Undici 7.29.0 and 8.10.0 and Sharp 0.35.2; main has no Undici override. (pnpm-lock.yaml:2967, 4e172a04b056)
• Proposed security resolution: The introduced overrides bound Undici updates within major versions 7 and 8 and raise the Sharp floor. (pnpm-workspace.yaml:14, 2fc418edb3e3)
• Resolved patched versions: The proposed lockfile resolves Undici 7.29.1 and 8.10.2 and Sharp 0.35.4; the Worker test configuration uses Cloudflare’s Vitest plugin, establishing the tooling dependency path. (pnpm-lock.yaml:2972, 2fc418edb3e3)
• Exact-head validation: CI succeeded on the pinned head; its jobs perform a frozen pnpm install before lint, typecheck, tests, and builds. The PR body also reports a Node 24.19 AWS Crabbox frozen install, 252 tests, a Worker deployment dry run, and unchanged generated auth schema. (.github/workflows/ci.yml:61, 2fc418edb3e3)
• Release Action provenance: The proposed SDK release pin is the commit referenced by the official v6.1.0 annotated tag. (ea17c68df891)
• CodeQL Action provenance: The proposed CodeQL pin is the commit referenced by the official v4.38.1 annotated tag, and exact-head CodeQL passed. (1c5b675653bb)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (19 earlier review cycles; latest 8 shown)

• reviewed 2026-09-04T05:59:25.458Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T10:03:06.135Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T17:59:52.475Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-05T11:59:30.399Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-12T11:53:13.358Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-22T09:29:31.964Z sha a8bcbf1 :: needs maintainer review before merge. :: none
• reviewed 2026-09-22T09:52:53.041Z sha 50ae64c :: needs maintainer review before merge. :: none
• reviewed 2026-09-30T04:43:22.854Z sha 2fc418e :: needs maintainer review before merge. :: none