[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Security fix. Transitive dependency pins for High and Critical advisories.

No new test was added. The change is a lockfile pin. The existing suite covers the packages that load these dependencies.

Pins

Package	Before	After	Reason
proxy-addr	2.0.7	2.0.8	CVE-2026-90711 (Critical). express accepts ^2.0.7.
undici 7	7.29.0	7.30.0	CVE-2026-19534 and CVE-2026-84961. miniflare pins 7.29.0. The override replaces it.
undici 8	8.11.2	8.11.2	Direct dependency in @cacheable/net. This release includes the 8.x fix (8.10.2).
minimatch 10	10.2.2	10.2.6	CVE-2026-27903 and CVE-2026-27904. glob accepts ^10.2.2.
minimatch 3	3.1.5	3.1.5	The 3.x fixes land in 3.1.4. This release is newer.
brace-expansion 1	1.1.12	1.1.21	DoS fixes through CVE-2026-102278. minimatch 3 accepts ^1.1.7.
brace-expansion 5	5.0.3	5.0.12	Same advisories. minimatch 10.2.6 accepts ^5.0.8.
wrangler	4.143.0	4.143.0	Direct devDependency. CVE-2026-0933 needs >= 4.59.1. The Socket row still says 4.50.0. That row is stale.
liquidjs	10.29.0	10.29.0	ecto requires ^10.29.0. The vulnerable range stops at 10.24.0. CVE-2026-30952 is fixed in 10.25.0.

tar, axios, and @isaacs/brace-expansion are not in this lockfile. This pull request does not add an override for an absent package. A forced major upgrade can break a later install.

express 5.2.1 now resolves body-parser 2.3.0. The express range is ^2.2.1. cacheable-request already depends on body-parser ^2.3.0. qs 6.14.1 left the tree with body-parser 2.2.2.

http-cache-semantics 4.2.0 (CVE-2026-93748)

No safe fix exists. This pull request does not change the dependency.

Version 4.3.0 (4 October 2026) fixes CVE-2026-93750. That fix covers the Vary wildcard. It does not cover max-stale. GHSA-ch52-4w7c-c8xp still marks every release through 4.2.0. The advisory lists no patched version.

The vulnerable code is reachable at runtime.

cacheable-request and @cacheable/net both depend on http-cache-semantics 4.2.0. Both build a CachePolicy with the default shared cache. The cache key is the method plus the URL. The key does not include Cookie or Authorization.

cacheable-request stores a security-zeroed entry when strictTtl is false. That is the default. satisfiesWithoutRevalidation then reads the caller Cache-Control header. A later request for the same URL can send a large max-stale value and receive that stored response. A shared cache can return one user's Set-Cookie response to another user.

@cacheable/net enables httpCachePolicy by default when a cache is present. timeToLive() returns 0 for a security-zeroed response. Cacheable treats a ttl of 0 as no expiry, so the entry stays. The same max-stale request can read it.

A cache that serves one user does not cross users. The libraries do not isolate entries by user. Any shared cache for the same URL can hit this path.

Test audit

This pull request does not add, change, or delete a test. The test gate has no item.

Verification

• pnpm install refreshed the lockfile. pnpm install --frozen-lockfile then passed.
• pnpm build passed. node scripts/test-build.mjs passed.
• pnpm test:ci passed for every workspace package.
• @cacheable/net ran against TEST_URL=http://localhost:3737.
• cache-manager had one Redis failure on the first parallel run (mdel native deleteMany). The same suite passed on the next run. The failure used a shared Redis while other packages ran.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T19:08:36.003057Z	48332c5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3616da2) to head (48332c5).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1740   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           29        29           
  Lines         3612      3612           
  Branches       809       822   +13     
=========================================
  Hits          3612      3612           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.