[peg]

Summary

Two CI security gates fail against main, so every open PR is red: npm audit --audit-level=high (Worker dev dependencies) and govulncheck (Go 1.26.8 standard library). This clears both.

 worker/package.json
   devDependencies
-    wrangler  4.131.0
+    wrangler  4.154.0   # miniflare -> sharp 0.35.5
-    vitest    4.1.11
+    vitest    4.1.12    # @vitest/mocker 4.1.12, vite 8.3.5, source-map-js 1.2.2
   overrides
-    undici    7.29.0
+    undici    7.30.1    # matches miniflare's own pin

Runtime Worker code (index.js, delivery.js, wrangler.jsonc) is unchanged.

 go.mod / Dockerfile
-  go 1.26.8                 golang:1.26.8-alpine
+  go 1.26.10                golang:1.26.10-alpine
-  golang.org/x/net v0.56.0
+  golang.org/x/net v0.60.0  # pulls x/crypto v0.57.0, x/sys v0.48.0, x/text v0.42.0

govulncheck reported 12 reachable advisories: net/http, net/textproto, crypto/tls and html/template (fixed in 1.26.9), crypto/x509 (1.26.10) and x/net (v0.60.0). The x/crypto bump overlaps Dependabot #110 (which goes to v0.58.0).

Supersedes Dependabot #113, #114, #116 and #117. Each of those bumps only one package, so the remaining advisories keep the audit failing. #115 (vitest 5 major) is left for a separate change.

Note: npm 10.9.8 crashes (Cannot read properties of null (reading 'edgesOut')) while resolving vitest's peer set, so the lockfile was resolved with npm 11.21.1. It stays at lockfileVersion: 3, and a clean npm ci with npm 10.9.8 installs it fine.

Evidence

• Before: npm audit --audit-level=high on main → 8 vulnerabilities (2 moderate, 6 high) (undici, vite, source-map-js, sharp, @vitest/mocker). This failed CI in run 40308541079.
  After: clean npm ci (npm 10.9.8) → npm audit --audit-level=high → found 0 vulnerabilities
• npm test: 57/57 passing
• npm run cf:check and npm run cf:check:staging: both dry runs bundle successfully
• Before: govulncheck on go1.26.8 → Your code is affected by 12 vulnerabilities from the Go standard library (run 41108049865)
  After: go1.26.10 → Your code is affected by 0 vulnerabilities.
• go build, go vet, go test ./... -race, staticcheck 2026.1: passing on go1.26.10
• Docker Compose smoke test not run locally (no Docker daemon here); CI covers it

Merge Danger

Door: two-way

Dev dependencies plus a Go patch-release bump. To roll back, revert the commits.

Blast Radius: toolchain

Wrangler builds and deploys the Worker bundle, so the next staging deploy runs on 4.154.0. The staging workflow's version and smoke checks will catch any bundling regression before production promotion. Go 1.26.10 is a patch release: the CLI, snare serve and the Docker image get the stdlib security fixes with no API changes.

🤖 Generated with Claude Code