[AmintaCCCP]

What

Force undici@^7.30.1 via npm overrides in cloudflare-worker to resolve Dependabot alert #77 — GHSA-xjj6-f33q-929c / CVE-2026-109869 (high severity): a malicious server can crash the Node process calling fetch() by returning more than five content codings and closing the connection before the body.

Why an override instead of a dependency bump

The vulnerable undici@7.29.1 arrives via wrangler (devDependency) → miniflare → undici. Neither the latest wrangler (4.152.0 → miniflare 5.20261019.2-beta) nor the latest stable miniflare (4.20260730.0) ships a fixed undici yet, so a plain dependency bump cannot clear the alert. The override follows the existing sharp override precedent in the same block.

Impact

• No impact on the deployed worker or indexed vectors. This undici instance is used only by the wrangler/miniflare local toolchain (wrangler dev); it is never bundled into the deployed worker, which runs on workerd's platform fetch. The Vectorize index and production traffic are untouched — this PR changes no worker source code.
• Low toolchain risk. 7.29.1 → 7.30.1 is a patch-level upgrade; easy to revert by removing the override line if anything misbehaves.

Verification

• npm ls undici resolves to 7.30.1 through wrangler → miniflare
• tsc --noEmit passes
• wrangler deploy --dry-run bundles cleanly with the env.VECTORIZE binding intact

Summary by CodeRabbit

• 维护
  • 更新了网络请求组件的版本约束；图像处理组件的现有版本约束保持不变。此项调整属于内部维护，不改变面向用户的功能或使用方式。

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T10:31:01.561061Z	7417410	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5f8b5c49-dadb-4843-8172-55b4723e3dfb

Commits

Reviewing files that changed from the base of the PR and between 47a2f46 and 7417410.

Files ignored due to path filters: 1

• cloudflare-worker/package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 1

• cloudflare-worker/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

Cloudflare Worker 的 overrides 配置新增 undici 版本约束 ^7.30.1。原有的 sharp 版本约束保持不变。

Changes: Worker 依赖覆盖

Layer / File(s)	Summary
依赖覆盖配置 cloudflare-worker/package.json	overrides 新增 undici: ^7.30.1，并保留 sharp: ^0.35.5。

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: Minimal · up to 74174

The localized dependency override introduces no identified merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		标题描述了 PR 的主要变更：在 cloudflare-worker 的 package.json 中新增 undici 覆盖版本 ^7.30.1，以修复 CVE-2026-109869（Dependabot #77）。原始摘要确认 overrides 中新增了 undici ^7.30.1，与标题一致。标题简洁，包含变更类型（fix(deps)）、目标（undici 覆盖）和动机（漏洞修复），可…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

标题描述了 PR 的主要变更：在 cloudflare-worker 的 package.json 中新增 undici 覆盖版本 ^7.30.1，以修复 CVE-2026-109869（Dependabot #77）。原始摘要确认 overrides 中新增了 undici ^7.30.1，与标题一致。标题简洁，包含变更类型（fix(deps)）、目标（undici 覆盖）和动机（漏洞修复），可以让团队成员快速理解主要变更。

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}