fix: upgrade wrangler to ^4.60.0 to address CVE-2026-0933

Upgrade wrangler from 4.58.0 to ^4.60.0 to fix the command injection vulnerability (CWE-78) in the --commit-hash parameter of wrangler pages deploy command. Fixes #627
2026-09-01 17:10:24 +08:00 · 2026-01-23 08:35:10 +09:00
2 changed files with 91 additions and 587 deletions
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -139,7 +139,7 @@
        "vite-tsconfig-paths": "^6.0.3",
        "vitest": "^4.0.16",
        "wait-on": "^9.0.3",
-        "wrangler": "4.58.0"
+        "wrangler": "^4.60.0"
    },
    "overrides": {
        "@openrouter/ai-sdk-provider": {