Repository navigation
feat(agents): wrangler-upgrade-security - #9
Conversation
Pin wrangler to 4.87.0 in deploy.yml (via wranglerVersion input) and package.json devDependencies. This remediates CVE-2026-0933 (OS Command Injection via unsanitised --commit-hash in CI) and a workerd use-after-free bug fixed in workerd v1.20260430.1 bundled with wrangler@4.87.0. Proposal: platform-gitops/agents-state/mctl-web/proposals/wrangler-upgrade-security/
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87fdc89070
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| with: | ||
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| workingDirectory: cloudflare-worker | ||
| wranglerVersion: "4.87.0" |
There was a problem hiding this comment.
Pinning wranglerVersion to 4.87.0 will likely break this deploy job because cloudflare/wrangler-action@v3 runs as a Node 20 action (runs.using: node20 in the action’s action.yml), while this commit’s lockfile shows wrangler@4.87.0 requires node >=22.0.0 (node_modules/wrangler.engines). In GitHub Actions, that mismatch can cause wrangler deploy to fail consistently for this workflow.
Useful? React with 👍 / 👎.
cloudflare/wrangler-action@v3 runs as a node20 action, but wrangler@4.87.0 requires node>=22 (engines.node in lockfile). Replace the action with actions/setup-node@v4 + global wrangler install + direct wrangler deploy so the deploy job uses a node 22 runtime that satisfies wrangler 4.87.
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Implements accepted proposal
mctl-web/wrangler-upgrade-security.Spec: https://github.com/mctlhq/mctl-gitops/tree/main/platform-gitops/agents-state/mctl-web/proposals/wrangler-upgrade-security/
Generated by mctl-agents Tier 2 implementer. Review carefully — this PR was opened automatically and the spec may have gaps.