Weekly review: fix double entity decoding in page titles

[DennisAlund]

Fix

extractTitle (src/title-fetch.ts)

• Wrong: chained .replace calls decoded < twice (to <), and String.fromCharCode split astral references (😀) into surrogate halves.
• Impact: auto-labelled link titles differ from the page's real title (low severity; output is escaped on render).
• Fix: single-pass decoder with fromCodePoint, out-of-range references left verbatim.
• Test: two new cases in src/__tests__/unit/title-fetch.test.ts; both fail before the fix, pass after. Full vitest suite green (1598).

Flagged for developer judgment (not changed)

1. Dependency advisories (yarn audit --groups dependencies: 2 critical, 28 high, all transitive via agents > @modelcontextprotocol/sdk > express, ajv > fast-uri, ip-address, proxy-addr). @modelcontextprotocol/sdk is patched in >=1.31.0. Upgrading agents/the MCP SDK is a non-drop-in bump, so left for you. Worth checking whether the Worker bundle actually includes the express paths.
2. src/rate-limit.ts: the in-memory window map never evicts expired entries, so an isolate seeing many distinct client keys grows unbounded until recycled. Low impact on Workers; a periodic sweep would fix it if wanted.
3. Review did not cover SDKs or e2e in depth; no SDK defects found in the areas sampled. yarn e2e not run (no src/pages, admin or client changes).

🤖 Generated with Claude Code

https://claude.ai/code/session_01REGVUtoAAVSPsdGVWCFLsJ

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	shrtnr	f6219d1	Oct 09 2026, 07:21 PM