fix(deps): pin nanoid to ^3.3.18 (GHSA-2v37-7h3g-55p8) - #62
Merged
Conversation
nanoid reaches the tree only through postcss, so Dependabot's security update job cannot raise it — update-subdependencies is off — and has been failing on every run instead of opening a PR. An override pins the patched 3.3.18, matching how sharp and postcss are already held. The lockfile was regenerated under node:22 (npm 10, same as CI and the Dockerfile), which drops the npm 11-only `libc` hints from four optional native packages. Both are glibc/musl pairs npm 10 selects by os/cpu anyway, and `npm ci` was verified green in a clean container.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Dependabot alert #4 —
nanoidhigh (GHSA-2v37-7h3g-55p8, CVSS 5.9):customAlphabet/customRandomloop forever whensizeis 0.Why an override
nanoidreaches the tree only throughpostcss, and Dependabot's security-update job runs withupdate-subdependencies: false. It cannot raise a transitive dependency, so instead of opening a PR it has been erroring out on every run (e.g. run 32355327201) — silently, because a failed updater job posts no PR. The override pins the patched 3.3.18, the same lever already used forsharpandpostcss.Lockfile note
Regenerated with
npm install --package-lock-onlyundernode:22(npm 10.9.8) — the same major as.nvmrc, CI'ssetup-node, and thenode:22-bookworm-slimDockerfile base. That drops the npm 11-onlylibchints from four optional native packages; they are glibc/musl pairs npm 10 resolves byos/cpuregardless, and the 33@emnapientries are intact.npm ciwas verified in a clean container and resolvesnanoid@3.3.18.Out of scope
npm auditstill reports 3 high findings fromprisma → @prisma/config → deepmerge-ts (<8.0.0). GitHub auto-dismissed that alert (#5) and the onlynpm audit fix --forcepath is a downgrade toprisma@6.12.0, so it waits on an upstream@prisma/configrelease.