From a042814625acadd8728f0c8f41becd96686334e0 Mon Sep 17 00:00:00 2001 From: Duncan Tourolle Date: Fri, 21 Aug 2026 17:38:54 +0200 Subject: [PATCH] Bump nanoid past the zero-size loop advisory `npm ci` in the UI started reporting one high-severity vulnerability: GHSA-2v37-7h3g-55p8, a custom generator called with size 0 spinning forever. Lockfile-only bump, 3.3.17 -> 3.3.18. Worth recording that this was never urgent. nanoid arrives as vite -> postcss, marked `"dev": true`, so it is build tooling and never reaches dist/. Postcss calls it with a fixed size for source-map ids, which is not the vulnerable path. npm audit scores the package in isolation, not the way this project calls it. `npm run build` still produces the same bundle. Co-Authored-By: Claude Opus 5 (1M context) --- ui/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ui/package-lock.json b/ui/package-lock.json index 82f576b..1e640fb 100644 --- a/ui/package-lock.json +++ b/ui/package-lock.json @@ -1465,9 +1465,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.17", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", - "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ {