From 57d1d496ff4c333eaab7c7c943a0c22d6e8ccb12 Mon Sep 17 00:00:00 2001 From: Theo <328805+theodesp@users.noreply.github.com> Date: Tue, 8 Sep 2026 12:20:04 +0100 Subject: [PATCH] fix: bump nanoid to >=3.3.18 via pnpm override Adds pnpm override to remediate GHSA-2v37-7h3g-55p8 (CVE-2026-67213): nanoid <3.3.18 can loop indefinitely in customAlphabet/customRandom when passed size=0. Pulled transitively via postcss. Co-Authored-By: Claude Opus 4.7 --- package.json | 1 + pnpm-lock.yaml | 9 +++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 7682c68..5438231 100644 --- a/package.json +++ b/package.json @@ -102,6 +102,7 @@ "overrides": { "@eslint/plugin-kit@<0.3.4": "^0.3.4", "minimatch@>=10.0.0 <10.2.3": "^10.2.3", + "nanoid@<3.3.18": "^3.3.18", "ajv@>=7.0.0-alpha.0 <8.18.0": "^8.18.0", "brace-expansion@<1.1.16": "^1.1.16", "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d3dbb36..b8bd538 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: '@eslint/plugin-kit@<0.3.4': ^0.3.4 minimatch@>=10.0.0 <10.2.3: ^10.2.3 + nanoid@<3.3.18: ^3.3.18 ajv@>=7.0.0-alpha.0 <8.18.0: ^8.18.0 brace-expansion@<1.1.16: ^1.1.16 brace-expansion@>=2.0.0 <2.1.2: ^2.1.2 @@ -3606,8 +3607,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -9150,7 +9151,7 @@ snapshots: ms@2.1.3: {} - nanoid@3.3.16: {} + nanoid@3.3.18: {} napi-postinstall@0.3.4: {} @@ -9490,7 +9491,7 @@ snapshots: postcss@8.5.25: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1