[ALikesToCode]

Both CI jobs stopped at their audit step, so the Worker tests and the Python tests never ran on pull requests. This change clears both audits. It touches no source files.

Node audit (undici)

• Route: wrangler → miniflare@5.20261006.1-alpha → undici@7.29.1. miniflare pins undici exactly, and the latest wrangler (4.152.0, with miniflare 5.20261019.2-beta) still pins 7.29.1, so bumping wrangler does not help.
• Fix: an npm overrides entry, "undici": "7.30.1", next to the existing @parcel/watcher and sharp overrides. 7.30.1 fixes GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472 and GHSA-xjj6-f33q-929c. package-lock.json changes only the undici entry.
• npm audit --audit-level=high now reports 0 vulnerabilities at every severity.

Python audit

• pillow 12.3.0 → 13.0.0 in requirements.lock and requirements-ci.lock. This fixes the advisories in the Pillow 13.0.0 security notes, including GHSA-78g4-xqwv-q3g8.
• certifi 2026.4.22 → 2026.10.19 in both locks (PYSEC-2026-4320 / GHSA-6q48-6c7w-9gw2). The same audit also flagged this, so CI would still have failed without it.
• filelock 3.32.4 → 4.2.1 in requirements-ci.lock only (CVE-2026-112940, CVE-2026-112913, CVE-2026-112907). It is a dev-tool dependency, pulled in by pip-audit through cachecontrol.
• The locks were recompiled with uv pip compile --generate-hashes and explicit --upgrade-package pins. A block-by-block comparison shows that only these packages changed, and the lock headers are unchanged.
• Hashes: every new hash matches both pypi.org and a second index. That is 83 files for pillow and 2 each for certifi and filelock, and neither lock is missing any file.
• pip-audit -r requirements.lock and pip-audit -r requirements-ci.lock both report no known vulnerabilities.

Pillow 13 API check

Image handling is in services/image_quality.py (Image.open, .width/.height, thumbnail, convert("RGB"), JPEG save), tests/test_image_quality.py (Image.frombytes, PNG save) and scripts/generate_favicon(s).py (Image.new, ImageDraw.ellipse, ICO save).

• None of these use anything Pillow 13 removed or changed: get_child_images, Image._show, ImageCms product fields, ExifTags.IFD.Makernote, fromarray mode changes, I-mode PNG saving, or getcolor with premultiplied alpha.
• The ICO change only affects images smaller than 16×16; the favicons are 32×32.
• thumbnail() now applies reducing_gap to RGBA/LA images, which is a minor resampling difference only.
• Python 3.10 is dropped; CI and the Docker image use 3.11.

Local results

• Python job, in order (static secret scan, ruff, mypy, bandit, pip-audit, pytest): all pass. Full suite: 5329 passed, 2 skipped, 975 subtests passed.
• Node job, in order:
  • npm ci passes, and npm audit reports 0 vulnerabilities.
  • Frontend build contracts: 2/2.
  • test:worker: 2079/2079.
  • D1 migration check: 43 migrations OK.
  • test:deploy: 19/19.
  • Free pool contracts: 8/8.
  • Client header contracts: 13/13.
• wrangler dev --local boots to Ready on http://localhost:8799.
• No files under worker/, routes/, services/, providers/ or utils/ changed, so tests/outbound_inventory.json is unchanged.

Follow-up

pnpm-lock.yaml, used by the cloudflare-build job, still resolves undici 7.29.0 through wrangler 4.138.0, because pnpm ignores npm's overrides. That job does not run an audit; this is left for a separate change.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fe789b4b-31ee-4f34-a958-bc60540b4a97

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T08:51:03.945389Z	c8b77eb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.