[szweibel]

Summary

The CI step bun audit --audit-level high fails on main because of advisories published this week:

• undici: GHSA-xjj6-f33q-929c, GHSA-4w7w-5xrc-9h26, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm (fixed in 7.30.1 and 8.12.2)
• zod: GHSA-mrhx-c7xc-m3w5 (fixed in 4.6.6)
• body-parser: GHSA-27r3-jxmh-p828 (fixed in 2.4.0)

Packages changed

Package	Before	After	How
zod	4.4.3	4.6.6	Root, cloudflare and frontend exact pins bumped. A zod override covers @cuny-ai-lab/cail-identity 5.2.6 and cail-log 0.6.4, which pin 4.4.3 exactly and have no newer release.
wrangler	4.143.1	4.153.0	Exact pin in cloudflare. Its miniflare 5.20261023.0-beta pins undici 7.30.1 itself.
undici (miniflare)	7.29.1	7.30.1	Through the wrangler update. No undici override.
undici (jsdom)	8.12.3	8.12.3	Unchanged. Already patched, and within jsdom's declared range.
body-parser	2.3.0	2.4.0	Override. 2.4.0 is within express's ^2.2.1 range.
qs	6.16.0	6.16.1	Existing override bumped.
content-type (nested under body-parser)	2.0.0	2.1.0	Required by body-parser 2.4.0.

No direct dependency changes major version.

Notes for review:

• wrangler 4.153.0 instead of an undici override. Miniflare under wrangler 4.143.1 pins undici 7.29.1 exactly, and Bun 1.3.14 ignores nested and version-qualified override keys. The only override that worked was a root one, which also forced jsdom's undici from 8.12.3 to 7.30.1, outside jsdom's ^8.9.0. Wrangler 4.153.0 is the first release whose miniflare pins undici 7.30.1. It was published on 2026-10-26, inside the seven-day min-release-age in ~/.npmrc, and Stephen approved lifting that age limit for this one install (bun install --minimum-release-age=0).
• Wrangler behavior since 4.143.1, from its changelog. Since 4.150.0, Wrangler generates and uploads source maps by default when upload_source_maps isn't set, so stack traces in logs point at the original source. This repo doesn't set upload_source_maps. The staging dry run uploads 9,172.57 KiB, or 1,914.70 KiB gzipped.
• body-parser. Bun has no narrow in-range refresh for a transitive package. bun update body-parser adds it as a root dependency, and deleting its lock entry re-resolves about 116 unrelated packages. So this uses an override, following the repo's existing pattern for patched transitive pins.
• qs. body-parser 2.4.0 requires qs ^6.16.1, so the existing 6.16.0 override had to move. 6.16.1 also fixes GHSA-6pq8-jhm2-2vcw (moderate).

Verification

All commands ran with the repo-pinned Bun 1.3.14 (first on PATH, so package scripts used it too) and Node 22.23.4. bun.lock stays at "lockfileVersion": 1.

• bun audit --audit-level high: exit 0 (on main: exit 1, with 6 high findings in body-parser, undici and zod).
• bun install --frozen-lockfile after removing all node_modules: exit 0.
• bun run check: exit 0. It covers lint, typecheck, backend tests (474 passed), frontend Vitest (43 files, 284 tests passed), tool tests (22 passed), build, and the staging wrangler deploy --dry-run. Rerun after the wrangler update, from a frozen install of the new lockfile: exit 0, with the dry run on wrangler 4.153.0.
• Local Worker process integration smoke (bun run dev plus bun run smoke, with the CI .dev.vars values): exit 0. Every step passed, including the isolated runtime and deletion of the synthetic workspace. This ran on the first commit; CI's process smoke job covers the wrangler update.
• Not run locally: browser acceptance (left to the CI lane).

The unfiltered bun audit still reports 18 moderate and 2 low findings, mostly in hono. They are outside this high-severity fix and don't fail the CI gate.

🤖 Generated with Claude Code