vyos-documentation.git/workers, branch agents-md-bot-workflow

Merge pull request #2172 from vyos/dependabot/npm_and_yarn/workers/postcss-8.5.23

2026-07-28T15:54:23+00:00

chore(deps): bump postcss from 8.5.17 to 8.5.23 in /workers

Merge pull request #2161 from vyos/dependabot/npm_and_yarn/workers/multi-1160cd7046

2026-07-28T15:19:42+00:00

chore(deps): bump sharp, @cloudflare/vitest-pool-workers and wrangler in /workers

chore(deps): bump postcss from 8.5.17 to 8.5.23 in /workers

2026-07-28T09:17:48+00:00

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.17 to 8.5.23. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.17...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot]

security: remediate CodeQL code-scanning alerts (#2171)

2026-07-28T09:16:46+00:00

* security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion) Remediates all 11 open CodeQL alerts on the default branch: - version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every DOM-derived path component (select.value, parsed location segments) at URL construction time via encodePath()/langUrlFor(), and tighten the parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx slugs — URLs stay byte-identical (asserted by tests). - workers/apex/test/manifest.test.ts (js/incomplete-multi-character- sanitization, alert 6): strip HTML comments from the root.html fixture repeatedly to a fixpoint instead of a single pass. - docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input to the fleet reusable workflow). The file is vendored stock DataTables 1.11.5; the flagged helpers are display/sort normalization, not sanitization boundaries. Excluding keeps the vendored copy byte-identical to upstream instead of hand-patching it. Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject); workers suite 103/103 green. 🤖 Generated by [robots](https://vyos.io) * security: normalize pre-existing percent escapes in encodePath Adversarial-review finding (Codex, medium): location.pathname returns well-formed escapes verbatim, so blind encodeURIComponent double-encoded them (%2E -> %252E), broke the HEAD probe on escaped deep links, and dumped the user at the version root. Each segment is now decoded first (malformed escapes keep the raw segment — no throw), then re-encoded to canonical single encoding. Decoding cannot resurrect dot-segments: the URL parser resolves '.'/'..' and their percent-encoded forms during navigation, so pathname never presents them (verified against the WHATWG parser in Node). workers suite 106/106 (+2 regression tests, mutation-verified). 🤖 Generated by [robots](https://vyos.io) * security: normalize percent escapes per run, not per segment Round-2 adversarial finding (Codex, medium): whole-segment decode meant one malformed escape (a%20b%zz) threw for the segment and double-encoded the valid escapes beside it. encodeSegment now decodes+re-encodes each well-formed %HH run independently; literal spans (including a bare '%') always pass through encodeURIComponent, so taint neutralization holds unconditionally; a run decoding to invalid UTF-8 stays verbatim (already pure %HH text). workers suite 108/108 (+2 discriminating regression tests). 🤖 Generated by [robots](https://vyos.io)

chore(deps): bump sharp, @cloudflare/vitest-pool-workers and wrangler

2026-07-25T20:32:07+00:00

Bumps [sharp](https://github.com/lovell/sharp) to 0.35.2 and updates ancestor dependencies [sharp](https://github.com/lovell/sharp), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies need to be updated together. Updates `sharp` from 0.34.5 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.2) Updates `@cloudflare/vitest-pool-workers` from 0.18.4 to 0.18.8 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.8/packages/vitest-pool-workers) Updates `wrangler` from 4.110.0 to 4.114.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.2 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.8 dependency-type: direct:development - dependency-name: wrangler dependency-version: 4.114.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot]

docs-gates: smoke per-probe retry + explicit UA; workers: broaden asset-ext classification

2026-07-22T14:06:27+00:00

smoke.py — BIC independence: probe requests now send an explicit User-Agent (vyos-docs-smoke/1.0) so the gate no longer depends on a Cloudflare Browser Integrity Check UA-skip rule surviving. The default Python-urllib UA was blocked by BIC until that exemption was added; a silent dependency on it is a latent gate failure the moment the rule is touched. smoke.py — propagation-race tolerance: each probe now retries up to 3 attempts (20s apart; MAX_ATTEMPTS + RETRY_SLEEP_SECONDS are module-level so tests can shrink them) and only fails after the final attempt. A freshly deployed worker version loses a brief propagation race in which a single probe is served by the PREVIOUS version (observed: status 307 + stale X-Docs-Build minutes after deploy), which previously failed the entire gate. Intermediate attempts log SMOKE-RETRY; only exhaustion logs SMOKE-FAIL and counts a failure. Retry fires only on a not-ok outcome (wrong status, wrong/missing build header, missing search mount, or a transport exception); a legitimately-expected 404 passes on the first attempt. workers/branch — broaden asset classification (CodeRabbit post-merge nit): fold .pdf into the case-insensitive ASSET_EXT_RE and add webp + otf, so uppercase .PDF and modern image/font assets get the longer asset cache class. /_static/ and /_images/ path checks unchanged. 🤖 Generated by [robots](https://vyos.io)

workers: bare-directory 301 via asset probe + asset-class images + config congruence test (review round 1)

2026-07-22T13:32:18+00:00

workers: html_handling none + worker index-mapping — RTD .html URL parity (smoke 307 fix)

2026-07-22T13:11:16+00:00

docs-infra: align vitest with pool-workers 0.18 peer (dependabot ERESOLVE)

2026-07-12T13:42:11+00:00

Dependabot bumped @cloudflare/vitest-pool-workers to 0.18.4 (peer: vitest ^4.1.0) while workers/package.json still pinned vitest ~3.2.0, so npm ci ERESOLVEs in workers/ on rolling (docs-build run 29153221240; apex-deploy affected too). Bump vitest to ~4.1.0 to match the peer. 0.18.4 also removed the `@cloudflare/vitest-pool-workers/config` subpath export in favor of a `cloudflareTest()` Vite plugin — vitest.config.ts updated to the new shape (defineConfig from vitest/config + plugins: [cloudflareTest(...)]), matching the package's own vitest-v3-to-v4 codemod. No other files reference the old API. Verified: clean `npm ci` from a deleted node_modules resolves without --force/--legacy-peer-deps, `npm audit` reports 0 vulnerabilities (ws/wrangler bumps stay in place), and the full suite (`npx vitest run`) passes 84/84 across all 9 test files. 🤖 Generated by [robots](https://vyos.io)

chore(deps): bump wrangler and @cloudflare/vitest-pool-workers (#2142)

2026-07-11T12:46:53+00:00

Bumps [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) to 4.110.0 and updates ancestor dependency [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers). These dependencies need to be updated together. Updates `wrangler` from 4.35.0 to 4.110.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.110.0/packages/wrangler) Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.18.4 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.4/packages/vitest-pool-workers) --- updated-dependencies: - dependency-name: wrangler dependency-version: 4.110.0 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>