chore(deps): bump nanoid past GHSA-2v37-7h3g-55p8 - #536
Merged
Conversation
`npm audit` is a required check, and a newly published advisory against nanoid <3.3.17 turned it red on every open pull request — including ones that touch nothing but Svelte components. The check fails before `npm test` and `npm run check` ever run, so it hides whatever the branch actually did. nanoid is not a direct dependency; it arrives under vite → postcss → nanoid, and postcss's range already admits the fixed release, so this is a lockfile-only bump (3.3.16 → 3.3.18, the current patch). Unlike the dompurify pin in #528 there is nothing to state in `package.json`: no override is needed to hold the floor. `npm audit` now reports 0 vulnerabilities; 843 tests pass and `npm run check` is clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
npm auditis a required check (.github/workflows/test.yml, guarded byscripts/workflowSecurityAudit.test.ts). A newly published advisory againstnanoid <3.3.17— GHSA-2v37-7h3g-55p8, high, custom generators can loop indefinitely when size is zero — turned it red on every open pull request, including ones that touch nothing related:The audit step runs before
npm testandnpm run check, so a redtestjob currently says nothing about the branch it is reporting on.What
Lockfile only, three lines:
nanoid is not a direct dependency — it arrives as
vite → postcss → nanoid, and postcss's range already admits the fixed release, sonpm audit fixresolves it without touchingpackage.json. Unlike the dompurify pin in #528 there is nooverridesentry to add: nothing is holding the version back, the lockfile was simply resolved before the fix existed.3.3.18 rather than the advisory's minimum 3.3.17 because that is the current patch release of the same line.
Verification
npm audit— found 0 vulnerabilities (was 1 high)npm test— 843/843 passnpm run check— 666 files, 0 errors, 0 warnings🤖 Generated with Claude Code