chore(deps): bump nanoid to 3.3.18 in web/frontend and web/backend - #583
Merged
Conversation
`npm audit` reported a high-severity advisory for nanoid 3.3.16 (GHSA-2v37-7h3g-55p8: custom generators can loop indefinitely when size is zero) in both web trees. It comes in transitively via postcss: web/frontend: postcss@8.5.24 -> nanoid@3.3.16 web/backend: vitest -> vite -> postcss@8.5.24 -> nanoid@3.3.16 Dependabot never raised an alert for it, so it would not have been fixed on its own. postcss@8.5.24 declares `nanoid: ^3.3.16`, and the fixed 3.3.18 already satisfies that range -- the lockfiles were simply pinned to 3.3.16 because that was the newest release when they were generated. So this is a plain `npm update nanoid`: two lockfile entries move, no package.json change and no `overrides` block needed. Impact was low to begin with: postcss and nanoid run only at build time (vite build / vitest) and nanoid never reaches the SPA bundle shipped in _ui_dist. This is hygiene, not an incident. Verified: `npm ci` succeeds in both trees, `npm run build` (`tsc -b && vite build`) passes in web/frontend, and `npm audit` reports 0 vulnerabilities in both.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the last outstanding
npm auditfinding in the two web trees, which Dependabot does not cover.What
npm auditreports a high-severity advisory fornanoid@3.3.16— GHSA-2v37-7h3g-55p8, "custom generators can loop indefinitely when size is zero" — in both trees. It arrives transitively through postcss:web/frontend:postcss@8.5.24 -> nanoid@3.3.16web/backend:vitest -> vite -> postcss@8.5.24 -> nanoid@3.3.16Dependabot never raised an alert for it (confirmed via
gh api repos/keboola/cli/dependabot/alerts), so it would not have been fixed on its own.Why a plain
npm updateand not anoverridesblockpostcss@8.5.24declaresnanoid: ^3.3.16, and the fixed3.3.18already satisfies that range. The lockfiles were pinned to3.3.16only because that was the newest release when they were generated —npm cithen reproduces it faithfully.An
overridesentry (the mechanism already used fordompurifyinweb/frontend/package.json) is only warranted when the fixed version falls outside the declared range. Here it does not, sonpm update nanoidis sufficient and leaves nothing extra to maintain. The diff is two lockfile entries; nopackage.jsonchanges.Impact
Low. postcss and nanoid run only at build time (
vite build/vitest); nanoid never reaches the SPA bundle shipped in_ui_dist. This is hygiene rather than an incident — which is also why it is a standalone PR rather than something rushed into a release.Verification
npm cisucceeds in bothweb/frontendandweb/backend(lockfiles are internally consistent)npm run build(tsc -b && vite build) passes inweb/frontend— the SPA is compiled into the wheel byhatch_build.py, so a broken build would ship a UI-less wheelnpm auditreports 0 vulnerabilities in both treesnpm ls nanoidconfirms3.3.18resolved in bothContext
Follow-up to the six Dependabot security PRs merged just before this one (#554, #555, #558, #559, #563, #564), which together closed 12 open Dependabot alerts. This covers the one finding
npm auditsees but Dependabot does not.Dependency-only change: no version bump and no changelog entry, matching how those six were handled.