v1.3.4

neverinfamous · 2026-04-06T12:33:02Z

Highlights

Dependency Updates: Secured all NPM dependencies to their latest compatible versions, resolving multiple Dependabot CVEs without manual intervention.
Documentation Refinements: Synched platform limits to comply with Docker Hub validation lengths and included an environment setup template.
CI Health Improvements: Updated Docker actions to Node 24 runtimes ahead of deprecation, pinned security actions, and added Dependabot support for Docker base images.

CI/CD

CI Health: Updated Docker actions (docker/build-push-action@v7, setup-buildx-action@v4, login-action@v4, metadata-action@v6) to native Node 24 runtimes to comply with the upcoming June 2026 deprecation deadline.
CI Health: Pinned trufflesecurity/trufflehog to robust @v3 tag to avoid floating reference risks.
CI Health: Added docker package ecosystem to Dependabot configuration to receive base image updates.

Documentation

Doc Audit: Refined repository documentation, fixed Docker Hub character limits on DOCKER_README.md, and created .env.example.

Changed

Dependency Updates: Updated npm dependencies to their latest wanted/latest compatible versions.

Security

Dependabot: Fixed Prototype Pollution via parse() in NodeJS flatted.
Dependabot: Fixed a malicious WebSocket 64-bit length handling issue in Undici that could overflow the parser and crash the client.
Dependabot: Fixed an HTTP Request/Response Smuggling issue in Undici.
Dependabot: Fixed a CRLF injection issue in undici via the upgrade option.
Dependabot: Fixed incorrect glob matching in picomatch caused by method injection in POSIX character classes.

Compare: v1.3.3...v1.3.4

cloudflare-workers-and-pages · 2026-04-06T12:33:24Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	do-manager	`13908f9`	Apr 06 2026, 12:40 PM

Copilot

Pull request overview

Release prep for v1.3.4, focusing on dependency/security updates, CI action refreshes, and documentation/release artifacts.

Changes:

Updated build/CI tooling (Vite chunking config, Docker GitHub Actions, TruffleHog pin) and Dependabot to track Docker base images.
Bumped npm dependencies + added picomatch override and Dockerfile P111 patching.
Refreshed docs/release artifacts (README/DOCKER_README badges, changelog + release notes, added .env.example and UNRELEASED.md).

Reviewed changes

Copilot reviewed 34 out of 35 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
vite.config.ts	Switches `manualChunks` to a function-based strategy (Rollup/Vite 8 compatible).
UNRELEASED.md	Adds an Unreleased header placeholder.
src/hooks/useSelection.ts	Simplifies `useState` typing for `Set<string>` initialization.
src/components/features/WebhookManager.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/StorageViewer.tsx	Simplifies several `useState` generics (error, editingKey, selectedKeys).
src/components/features/SqlConsole.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/NamespaceList.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/MetricsDashboard.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/JobHistory.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/InstanceList.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/InstanceDiffDialog.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/ImportKeysDialog.tsx	Simplifies state generics for `error`, counters, and strings.
src/components/features/HealthDashboard.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/GlobalSearch.tsx	Simplifies state generics for `error` and `selectedNamespaces`.
src/components/features/BackupManager.tsx	Removes redundant `useState<string>` generic for `error`.
src/components/features/AlarmManager.tsx	Removes redundant `useState<string>` generic for `error`.
releases/v1.3.4.md	Adds v1.3.4 release notes content.
README.md	Replaces hardcoded version badge with GitHub release badge; removes stale “Last Updated”.
package.json	Bumps version to 1.3.4 and updates dependencies/devDependencies/overrides (adds `picomatch`).
Dockerfile	Extends npm P111 patching to include `picomatch` in builder + runtime stages.
DOCKER_README.md	Updates version badge + shortens header description; generalizes tag example.
CHANGELOG.md	Major restructure into Keep-a-Changelog style + adds v1.3.4 entry.
.github/workflows/secrets-scanning.yml	Pins TruffleHog to a specific v3 release tag.
.github/workflows/docs-drift-detector.md	Removes agentic docs drift workflow source.
.github/workflows/docs-drift-detector.lock.yml	Removes compiled lock workflow for docs drift detector.
.github/workflows/docker-publish.yml	Updates Docker actions to newer major versions.
.github/workflows/dependency-maintenance.md	Removes agentic dependency maintenance workflow source.
.github/workflows/dependency-maintenance.lock.yml	Removes compiled lock workflow for dependency maintenance.
.github/workflows/ci-health-monitor.md	Removes agentic CI health monitor workflow source.
.github/workflows/ci-health-monitor.lock.yml	Removes compiled lock workflow for CI health monitor.
.github/workflows/agentics-maintenance.yml	Removes generated agentics maintenance workflow.
.github/dependabot.yml	Adds Dependabot updates for the Docker ecosystem.
.env.example	Adds an environment template for local/container configuration.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-06T12:39:59Z

Dockerfile

 # Patch npm's own dependencies (P111 - keep versions in sync with package.json overrides)
-# npm bundles vulnerable versions of glob, tar, and minimatch
+# npm bundles vulnerable versions of glob, tar, minimatch, and picomatch
 RUN cd /tmp && \
    npm pack glob@13.0.6 && \
    npm pack tar@7.5.11 && \
    npm pack minimatch@10.2.4 && \
+    npm pack picomatch@4.0.4 && \


The Dockerfile now patches npm’s bundled picomatch, but the later # Security Notes block still lists only glob, tar, and minimatch. Please update the Security Notes to include the patched picomatch version so the documented runtime contents match what the image actually ships (and stays in sync with package.json overrides).

Copilot · 2026-04-06T12:39:59Z

CHANGELOG.md

-
- **P111 Exact Pin**: Changed minimatch override from `^10.2.4` (caret) to `10.2.4` (exact) to prevent lockfile drift from Dockerfile patch version
+- **CI Health:** Updated Docker actions to native Node 24 runtimes to comply with the upcoming June 2026 deprecation deadline.
+- **CI Health:** Pinned `trufflesecurity/trufflehog` to robust `@v3` tag to avoid floating reference risks.


This changelog entry says TruffleHog was pinned to a "robust @V3" tag, but the workflow is pinned to trufflesecurity/trufflehog@v3.94.2. Update the wording to match the actual pin (or adjust the workflow if you intended to use the floating @v3 major tag).

Suggested change

- **CI Health:** Pinned `trufflesecurity/trufflehog` to robust `@v3` tag to avoid floating reference risks.

- **CI Health:** Pinned `trufflesecurity/trufflehog` exactly to `@v3.94.2` to avoid floating reference risks.

Copilot · 2026-04-06T12:39:59Z

CHANGELOG.md

 ### CI/CD

- **Docker Publish Trigger Fix**: Docker images now only build on tag pushes (`v*`), preventing duplicate builds on every push to main
- **Tag Condition Fix**: Updated `refs/heads/main` conditions to `startsWith(github.ref, 'refs/tags/v')` for tag-triggered workflows
-
-### Security
-
- **P111 Exact Pin**: Changed minimatch override from `^10.2.4` (caret) to `10.2.4` (exact) to prevent lockfile drift from Dockerfile patch version
+- **CI Health:** Updated Docker actions to native Node 24 runtimes to comply with the upcoming June 2026 deprecation deadline.
+- **CI Health:** Pinned `trufflesecurity/trufflehog` to robust `@v3` tag to avoid floating reference risks.
+- **CI Health:** Added `docker` package ecosystem to Dependabot configuration.


This release’s CI/CD section doesn’t mention that several agentic/maintenance workflows were removed in this PR (docs drift detector, dependency maintenance, CI health monitor, and the generated agentics-maintenance workflow). If that removal is intentional, it should be called out here (and/or in the PR description) since it materially changes CI/automation coverage; otherwise, restore the removed workflows.

Copilot · 2026-04-06T12:39:59Z

releases/v1.3.4.md

+### CI/CD
+
+- **CI Health:** Updated Docker actions (`docker/build-push-action@v7`, `setup-buildx-action@v4`, `login-action@v4`, `metadata-action@v6`) to native Node 24 runtimes to comply with the upcoming June 2026 deprecation deadline.
+- **CI Health:** Pinned `trufflesecurity/trufflehog` to robust `@v3` tag to avoid floating reference risks.


This release note says TruffleHog was pinned to a "robust @V3" tag, but the workflow is pinned to trufflesecurity/trufflehog@v3.94.2. Please update the wording to match the actual pin (or change the workflow if you intended a floating major tag).

Suggested change

- **CI Health:** Pinned `trufflesecurity/trufflehog` to robust `@v3` tag to avoid floating reference risks.

- **CI Health:** Pinned `trufflesecurity/trufflehog` to exact version `@v3.94.2` to avoid floating reference risks.

Copilot · 2026-04-06T12:40:00Z

.env.example

+# Server & General
+PORT=8787
+NODE_ENV=production
+


.env.example includes PORT and NODE_ENV, but the repo doesn’t reference these variables and the Docker image’s default CMD hardcodes --port 8787. Either wire these env vars into the runtime/compose instructions (so changing them has an effect) or remove them from the template to avoid implying they are supported configuration knobs.

Suggested change

# Server & General

PORT=8787

NODE_ENV=production

Chris & Mike added 6 commits April 6, 2026 07:27

chore: update dependencies and security patches

1b773fb

docs: standardize CHANGELOG.md to Keep a Changelog

984f0fd

refactor(ui): remove redundant type annotations in useState hooks

7e06c21

Remove dates from readmes.

d838267

Make version references in readmes dynamic.

8c17cdb

docs(audit): sync platform limits and provide env.example

9219962

Copilot AI review requested due to automatic review settings April 6, 2026 12:33

Copilot started reviewing on behalf of neverinfamous April 6, 2026 12:33 View session

v1.3.4 - Dependency updates, CI Health & Security patches

13908f9

neverinfamous force-pushed the release/v1.3.4-fix-v2 branch from 4d715aa to 13908f9 Compare April 6, 2026 12:39

Copilot AI reviewed Apr 6, 2026

View reviewed changes

neverinfamous closed this Apr 6, 2026

neverinfamous deleted the release/v1.3.4-fix-v2 branch April 6, 2026 13:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v1.3.4 - Dependency updates, CI Health & Security patches#81

v1.3.4 - Dependency updates, CI Health & Security patches#81
neverinfamous wants to merge 7 commits intomainfrom
release/v1.3.4-fix-v2

neverinfamous commented Apr 6, 2026

Uh oh!

cloudflare-workers-and-pages bot commented Apr 6, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	- CI Health: Pinned `trufflesecurity/trufflehog` to robust `@v3` tag to avoid floating reference risks.
	- CI Health: Pinned `trufflesecurity/trufflehog` exactly to `@v3.94.2` to avoid floating reference risks.

Conversation

neverinfamous commented Apr 6, 2026

v1.3.4

Highlights

CI/CD

Documentation

Changed

Security

Uh oh!

cloudflare-workers-and-pages bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cloudflare-workers-and-pages bot commented Apr 6, 2026 •

edited

Loading