docs: dependency audit notes - #17

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

This pull request was not opened by the account owner. It was created with a leaked GitHub CLI OAuth token for @StringKe during a CI poisoning attack on 2026-11-10 and 2026-11-11 (UTC).

What the attacker did: pushed a workflow change to the default branch (or a temporary chore/* branch) that read all GitHub Actions secrets, variables, the repository tarball and recent commit history, sent them to 18.143.168.96, then reverted the change and deleted the workflow runs. This PR only adds a harmless-looking doc file; its purpose was to trigger pull_request workflows against the poisoned default branch.

Status: the token has been revoked, this PR is closed, the wfx-docs branch is deleted, the attack commits have been removed from the default branch history, and the leaked secrets are being rotated. Do not merge, reopen or reuse anything from this PR. If you maintain this repository, treat every Actions secret it had on 2026-11-10 as compromised and rotate it.

此 PR 不是仓库所有者本人提交的。攻击者在 2026-11-10 至 11-11（UTC）期间盗用了 @StringKe 的 GitHub CLI token，对多个仓库做了 CI 投毒：往默认分支或临时 chore/* 分支推入恶意 workflow，读取全部 Actions secrets、变量、仓库源码和近期提交历史，外发到 18.143.168.96，随后还原改动并删除运行记录。本 PR 只加了一个文档文件，用来触发对已投毒默认分支的 pull_request 运行。

处置：token 已撤销，PR 已关闭，wfx-docs 分支已删除，攻击 commit 已从默认分支历史中移除，泄露的 secrets 正在轮换。请勿合并、重新打开或复用本 PR 的任何内容。仓库维护者请把 2026-11-10 时该仓库的全部 Actions secrets 视为已泄露并完成轮换。