fix: keep transitive nanoid audit recovery enforced

[kang-heewon]

Outcome

The repository now fails its dependency-audit regression suite if the workspace or frozen lockfile stops constraining transitive nanoid 3.x paths to the patched 3.3.17 release.

The secure resolution itself reached trunk in #1781 and already restores pnpm security:audit-policy; this PR makes that security outcome an executable repository contract so a later install cannot silently reintroduce GHSA-2v37-7h3g-55p8.

Fixes #1782

Reviewer context

• The regression reads both pnpm-workspace.yaml and pnpm-lock.yaml.
• It verifies the effective override, package resolution, and every transitive snapshot edge that names nanoid.
• Audit classification and suppression policy are unchanged; no GHSA exception is added.
• No publishable package, public API, dependency declaration, or lockfile content changes in this PR, so no changeset is required.

Verification

• Vulnerable base 6795b4d683b69374ee7d8f83eee5b6620d14caaa records nanoid@3.3.16; current trunk records only nanoid@3.3.17
• pnpm exec vitest run scripts/tests/dependency-audit-policy.spec.ts --config vitest.config.ts — 58 passed
• pnpm security:audit-policy — passed with 0 blocking findings
• pnpm test:release-gates — 43 files and 1,167 tests passed
• pnpm changeset-required:check -- --base origin/trunk --head HEAD — passed; no publishable behavior change
• pnpm check — 24/25 passed; one check not applicable
• Pre-push workspace test — 234/234 tasks passed
• Pre-push workspace typecheck — 233/233 tasks passed
• Oxlint, Oxfmt, and git diff --check — passed

Review gates

• Correctness and regression — PASS. The test covers both configuration and effective lockfile state; removal of the override or restoration of the vulnerable 3.3.16 resolution violates its assertions, while the live audit has zero blockers.
• API, security, compatibility, and release — PASS. The fix retains strict audit classification without adding a suppression. This PR changes only a repository test and requires no package release metadata.
• Maintainability and minimality — PASS. The diff is one focused test using the existing YAML parser and current pnpm lockfile contract. No production or policy code changes are included.
• Independent adversarial review — PASS. No actionable finding was identified after checking correctness, scope, security bypasses, and lockfile coverage.

Residual risk

The regression follows pnpm's current packages and snapshots.dependencies lockfile shape. A future lockfile schema change or a nanoid edge represented through another dependency field will require updating the assertion; pnpm security:audit-policy remains the primary advisory backstop.

Summary by CodeRabbit

• 테스트
  • 프로젝트 의존성 검증을 강화했습니다.
  • 워크스페이스 및 잠금 파일에서 nanoid가 안전한 지정 버전(3.3.17)으로 일관되게 관리되는지 자동으로 확인합니다.
  • 간접 의존성에서도 다른 버전이 해석되지 않는지 검증해 의존성 안정성과 보안을 높였습니다.

[coderabbitai]

Warning

Review limit reached

@kang-heewon, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 41 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fd4de062-aa1a-4e92-ab21-4ee97210cc1d

📥 Commits

Reviewing files that changed from the base of the PR and between e366bfc and 8bd86f4.

📒 Files selected for processing (1)

• scripts/tests/dependency-audit-policy.spec.ts

📝 Walkthrough

Walkthrough

저장소 루트 해석과 YAML 파싱을 추가했습니다. workspace와 lockfile의 nanoid override 및 모든 해석 버전이 3.3.17인지 검증하는 테스트를 추가했습니다.

Changes

nanoid 의존성 정책 검증

Layer / File(s)	Summary
nanoid 버전 고정 검증 scripts/tests/dependency-audit-policy.spec.ts	저장소 루트를 계산하고 YAML 파일을 파싱합니다. workspace override, lockfile의 해석 버전 및 transitive resolution이 모두 3.3.17인지 검사합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• croco-dev/framework#1208: nanoid 버전 및 lockfile 정책 테스트를 dependency-audit 정책 테스트에 추가했습니다.
• croco-dev/framework#1411: 단일 nanoid 버전을 검증하는 dependency-audit 테스트를 추가했습니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 트랜지티브 nanoid 감사 복구를 계속 강제한다는 핵심 변경을 간결하게 설명합니다.
Linked Issues check	✅ Passed	[#1782]의 nanoid 트랜지티브 경로에 대해 workspace override와 lockfile 해석을 검증하는 회귀 테스트를 추가했으며, audit 복구 목표와 일치합니다.
Out of Scope Changes check	✅ Passed	변경은 dependency-audit 회귀 테스트 한 파일에 한정되며, 연결 이슈의 nanoid 검증 범위를 벗어난 코드 변경이 없습니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1782-nanoid-audit-policy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	39.3μs	30.0ms	8.2μs	+380.7%	❌	-
CrocoApp lambdaHandler (10 controllers)	2.2ms	50.0ms	258.4μs	+758.8%	❌	-
Lambda cold-start simulation	1.7ms	80.0ms	418.1μs	+299.1%	❌	-
Lambda cold-start with headers	1.5ms	80.0ms	369.7μs	+302.4%	❌	-
Lambda cold-start with binary body	1.5ms	80.0ms	339.1μs	+344.2%	❌	-
Lambda cold-start with query params	1.5ms	80.0ms	301.3μs	+384.3%	❌	-
Lambda cold-start with authorizer context	1.4ms	80.0ms	299.8μs	+380.1%	❌	-
Lambda cold-start realistic scenario	1.5ms	80.0ms	299.2μs	+385.6%	❌	-
EventBusConfig.start (10 handlers)	1.9μs	10.0ms	1.4μs	+32.1%	❌	-
EventPublisher.publishNow single event	2.1μs	2.0ms	1.7μs	+22.6%	❌	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.1μs	+0.0%	✅	-
Container.get singleton (cold)	66.8μs	5.0ms	70.3μs	-4.9%	✅	-
Container.register × 50 components	3.1ms	10.0ms	3.2ms	-2.5%	✅	-
Container.validate (50 components)	3.6ms	20.0ms	3.4ms	+6.0%	✅	-
Container.get singleton (warm)	1.7μs	500.0μs	1.6μs	+1.8%	✅	-
TelemetryRuntime.init (lambda preset)	2.3μs	200.0ms	1.1ms	-99.8%	✅	-
lambdaPreset config creation	1.4μs	2.0ms	1.4μs	+0.7%	✅	-

_{Updated: 2026-08-08T17:55:35.974Z · Commit: 95776e3}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/tests/dependency-audit-policy.spec.ts`:
- Around line 31-41: Update the snapshot type and transitive Nanoid collection
around resolvedNanoidVersions and transitiveNanoidVersions to include
optionalDependencies.nanoid alongside dependencies.nanoid. Collect either string
value without duplicating entries, preserving the existing policy checks for all
discovered versions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c91ba3e0-8c4d-43f2-801d-a84235da8658

📥 Commits

Reviewing files that changed from the base of the PR and between 7e88b45 and e366bfc.

📒 Files selected for processing (1)

• scripts/tests/dependency-audit-policy.spec.ts

[kang-heewon]

@coderabbitai resolve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.