Skip to content

fix(deps): Bump Cloudflare toolchain and pin zod to patched release - #1912

Merged
dcramer merged 2 commits into
mainfrom
deps/cloudflare-toolchain-zod
Nov 3, 2026
Merged

fix(deps): Bump Cloudflare toolchain and pin zod to patched release#1912
dcramer merged 2 commits into
mainfrom
deps/cloudflare-toolchain-zod

Conversation

@sentry-junior

@sentry-junior sentry-junior Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Semgrep keeps flagging zod usage (GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404) on any PR that touches zod schemas, e.g. #1861. The code we ship already resolves a patched zod@4.6.7. The flagged copies come only from stale Cloudflare dev tooling in mcp-cloudflare:

  • @cloudflare/vitest-plugin@1.4.6 pins zod@4.6.5 exactly.
  • miniflare@4.20251011.1 pins zod@3.22.3 (no patched 3.x exists). It comes in through @cloudflare/vite-plugin@1.13.15, which mcp-cloudflare pinned locally below the catalog's ^1.31.0.

Changes

  • packages/mcp-cloudflare takes @cloudflare/vite-plugin from catalog: instead of its own ^1.13.15 pin.
  • The Cloudflare toolchain moves together to mutually compatible versions in the catalog: @cloudflare/vite-plugin 1.66.0, @cloudflare/vitest-pool-workers/vitest-plugin 1.4.9, wrangler 4.154.0, miniflare 5.20261023.1-beta. These are about a week old; I skipped the Nov 1 releases. minimumReleaseAgeExclude entries are updated to match.
  • Workspace override zod: ^4.6.6 keeps every copy on a patched release.

Result: the lockfile resolves a single zod@4.6.7.

Verification

Locally: pnpm install --frozen-lockfile, pnpm run tsc, pnpm run lint, pnpm run build, and the mcp-cloudflare tests (447 passed). Peer dependency warnings went down.

Not tested: wrangler dev or a deploy on the new wrangler/miniflare. Worth a look before merging since this is the tooling that builds and deploys the hosted MCP server.

Related: #1861

Co-Authored-By: David Cramer dcramer@users.noreply.github.com

via @dcramer.

--

View Session [Sentry]

@sentry-junior @dcramer
fix(deps): Bump Cloudflare toolchain and pin zod to patched release
d04e2b3 
Semgrep flags zod usages under GHSA-mrhx-c7xc-m3w5 because the lockfile
still carried zod@3.22.3 (miniflare via @cloudflare/vite-plugin@1.13.15,
which mcp-cloudflare pinned below the catalog) and zod@4.6.5
(@cloudflare/vitest-plugin@1.4.6 plus ranged deps locked to it).

- mcp-cloudflare now takes @cloudflare/vite-plugin from the catalog
- Catalog moves to a consistent Cloudflare set: vite-plugin 1.66.0,
  vitest-plugin 1.4.9, wrangler 4.154.0, miniflare 5.20261023.1-beta
- Override zod to ^4.6.6 so every copy stays on a patched release

The lockfile now resolves a single zod@4.6.7.

Co-Authored-By: David Cramer <23610+dcramer@users.noreply.github.com>
@vercel

vercel Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
sentry-local Ready Ready Preview Nov 3, 2026 9:33pm UTC

Request Review

@github-actions github-actions Bot added the risk: medium PR risk score: medium label Nov 3, 2026
@semgrep-code-getsentry

semgrep-code-getsentry Bot commented Nov 3, 2026

Copy link
Copy Markdown

Semgrep found 6 ssc-9c34c675-756b-44e8-9512-28718930fef2 findings:

🟠 High severity issue identified in your code:

Risk: Affected versions of @cloudflare/workerd-darwin-64, @cloudflare/workerd-darwin-arm64, @cloudflare/workerd-linux-64, @cloudflare/workerd-linux-arm64, @cloudflare/workerd-windows-64, @duckdb/node-api, @duckdb/node-bindings, @duckdb/node-bindings-darwin-arm64, @duckdb/node-bindings-darwin-x64, @duckdb/node-bindings-linux-arm64, @duckdb/node-bindings-linux-arm64-musl, @duckdb/node-bindings-linux-x64, @duckdb/node-bindings-linux-x64-musl, @duckdb/node-bindings-win32-arm64, @duckdb/node-bindings-win32-x64, @napi-rs/canvas, @napi-rs/canvas-linux-arm64-gnu, @napi-rs/canvas-linux-x64-gnu, @napi-rs/canvas-linux-x64-musl, @oven/bun-darwin-aarch64, @oven/bun-darwin-x64, @oven/bun-darwin-x64-baseline, @oven/bun-freebsd-aarch64, @oven/bun-freebsd-x64, @oven/bun-linux-aarch64, @oven/bun-linux-aarch64-android, @oven/bun-linux-aarch64-musl, @oven/bun-linux-x64, @oven/bun-linux-x64-android, @oven/bun-linux-x64-baseline, @oven/bun-linux-x64-musl, @oven/bun-linux-x64-musl-baseline, @oven/bun-windows-aarch64, @oven/bun-windows-x64, @oven/bun-windows-x64-baseline, @skia-canvas/linux-arm64-glibc, @skia-canvas/linux-arm64-musl, @skia-canvas/linux-x64-glibc, @skia-canvas/linux-x64-musl, @sparticuz/chromium, @yao-pkg/pkg-fetch, @zkl2333/freetype-wasm, canvaskit-wasm, chrome-aws-lambda, duckdb, electron, electron-nightly, fonteditor-core, iltorb, kuzu, kuzu-wasm, lbug, node-aix-ppc64, node-darwin-x64, node-libcurl, node-linux-arm64, node-linux-armv7l, node-linux-ppc64le, node-linux-s390x, node-linux-x64, node-sunos-x64, node-win-arm64, node-win-x64, node-win-x86, nodejs-mobile-react-native, pkg-fetch, playwright-chromium, playwright-core, puppeteer, skia-canvas, wawoff2, woff2-encoder, and workerd are vulnerable to Out-of-bounds Write. These packages use a version of the Brotli C library (1.0.3 through 1.2.0) that has an out-of-bounds write in the Brotli decoder. Decoding attacker-controlled Brotli data (for example HTTP responses, request bodies, WOFF2 fonts or Parquet files) can corrupt memory and may lead to denial of service, memory disclosure or remote code execution. Upgrade to a fixed version where one is available.

Fix: Upgrade this library to at least version 1.20261027.1 at toolkit/pnpm-lock.yaml:9340.

Reference(s): https://github.com/advisories/GHSA-cust-0000-0034

@sentry-junior
fix(deps): Bump Cloudflare toolchain to workerd with patched Brotli
b38a862 
Semgrep flags workerd 1.20261023.1 (Brotli decoder out-of-bounds write,
GHSA-cust-0000-0034; fixed in workerd >= 1.20261027.1). The first
Cloudflare releases on a fixed workerd are the Nov 1 set, so move the
toolchain together: vite-plugin 1.67.0, vitest-plugin 1.4.12,
wrangler 4.156.1 and miniflare 5.20261101.0-beta (workerd 1.20261101.1).
@sentry-junior

sentry-junior Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

Addressed in b38a862. No Cloudflare release before Nov 1 depends on a patched workerd (>= 1.20261027.1). Wrangler 4.154–4.156.0 all pin 1.20261023.1. So the toolchain now moves together to the Nov 1 set: @cloudflare/vite-plugin 1.67.0, @cloudflare/vitest-plugin 1.4.12, wrangler 4.156.1 and miniflare 5.20261101.0-beta. The lockfile now resolves a single workerd@1.20261101.1 (plus its platform packages) and still a single zod@4.6.7.

Locally: frozen install, tsc, lint, full build and mcp-cloudflare tests (447 passed). wrangler dev and deploy are still untested on the new versions.

@dcramer
dcramer merged commit ed3dee1 into main Nov 3, 2026
44 of 45 checks passed
@dcramer
dcramer deleted the deps/cloudflare-toolchain-zod branch November 3, 2026 22:01
@sentry-release-bot sentry-release-bot Bot mentioned this pull request Nov 5, 2026
Closed
7 tasks done

This branch was successfully deployed

1 active deployment
Preview — b38a8626 Deployed Nov 3, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@dcramer dcramer

Labels

risk: medium PR risk score: medium

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dcramer