fix: bump nanoid to 3.3.18 (GHSA-2v37-7h3g-55p8, DEVX-8508) - #27
Merged
Conversation
nanoid before 3.3.18 (3.x line) can infinite-loop in customAlphabet/ customRandom when size is 0. It is a transitive dependency of postcss (nanoid: ^3.3.12), which already admits 3.3.18, so this is a lockfile-only refresh with no package.json changes required. Refs DEVX-8508. Co-Authored-By: Warp <agent@warp.dev>
Contributor
Author
|
This PR was generated with Warp.   |
liliwilson
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the transitive
nanoiddependency from3.3.16to3.3.18to resolve GHSA-2v37-7h3g-55p8 (Dependabot alert 36):nanoid's custom generators (customAlphabet/customRandom) can loop indefinitely whensizeis0.This repo is on the
nanoid3.x line (patched in3.3.18); the>= 4.0.0, < 5.1.6range from the advisory (patched in5.1.6) does not apply here.Refs DEVX-8508.
Changes
package-lock.json:node_modules/nanoidbumped3.3.16→3.3.18(version,resolved,integrityonly).package.jsonchanges:nanoidis a transitive dependency ofpostcss(nanoid: ^3.3.12), which already permits3.3.18, so nooverridesentry was needed.package-lock.jsonis exactly this one entry (3 lines changed).Verification
npm install— installs cleanly;npm ls nanoidconfirmsdo-things > @tailwindcss/postcss > postcss@8.5.18 (overridden) > nanoid@3.3.18.npm audit—nanoidno longer appears in the vulnerability list. Remaining findings (postcss,brace-expansion) are pre-existing and tracked separately (e.g. fix: update postcss to resolve CVE-2026-69153 #25); unrelated to this change.npm run lint— passes (✔ No ESLint warnings or errors).npm run build— passes (next buildcompiles and generates pages successfully).npm cifails in this sandbox on both the base branch and this branch (pre-existingMissing: @emnapi/runtime@1.11.3 / @emnapi/core@1.11.3 from lock file, an optional-platform-dependency mismatch unrelated tonanoid);npm installwas used instead for verification, per the "smallest change" guidance to avoid unrelated lockfile churn from a full regenerate.