Fix double entity decoding in fetched page titles

[DennisAlund]

Weekly defect review. One fix; dependency findings are in the comment below.

What was wrong: extractTitle (src/title-fetch.ts) decoded & first, then </>/". A title containing the literal text < became <. Code points above U+FFFF went through String.fromCharCode and produced broken surrogates.

Impact: Wrong auto-generated link titles (low severity; output is escaped on render).

Fix: Decode every entity in a single pass and use String.fromCodePoint. No API or contract change.

Tests: Two new cases in src/__tests__/unit/title-fetch.test.ts failed before the fix and pass after. Full yarn test: 1598 passed. No src/pages, src/admin or client paths touched, so e2e not required.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vuitu9gf4wHQCs8NPs5NXN

---

Generated by Claude Code

[DennisAlund]

Dependency drift (flagged, not changed; needs a decision)

yarn audit reports 2 high advisories in runtime dependencies:

• @modelcontextprotocol/sdk 1.30.0, patched in >=1.31.0 (latest 1.32.1).
• @modelcontextprotocol/client 2.0.0, patched in >=2.2.0 (latest 2.3.1). @modelcontextprotocol/server is also at 2.0.0 (latest 2.3.1).

Both sit on the MCP surface, so I left them for a developer to upgrade and run the MCP tests against.

Transitive advisories in dev tooling only (via wrangler/miniflare/vitest): sharp (>=0.35.5), undici (>=7.29.1), source-map-js (>=1.2.2). They clear with a wrangler/vitest-pool bump.

Safe patch/minor candidates: hono 4.13.10 to 4.13.13, zod 4.6.5 to 4.6.7, @cloudflare/workers-oauth-provider 1.2.1 to 1.2.3, wrangler 4.143.0 to 4.151.1. Majors (vitest 5, typescript 7, agents 0.28) not recommended unprompted.

Reviewed with no defects found: src/redirect.ts, src/access.ts, and the SSRF guard in src/title-fetch.ts.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	shrtnr	4622467	Oct 16 2026, 07:20 PM