From 79d28039a51a44a8fb416f617f349dd03b65c08f Mon Sep 17 00:00:00 2001 From: Petr Date: Thu, 13 Aug 2026 23:44:11 +0200 Subject: [PATCH] chore(deps): bump nanoid to 3.3.18 in web/frontend and web/backend `npm audit` reported a high-severity advisory for nanoid 3.3.16 (GHSA-2v37-7h3g-55p8: custom generators can loop indefinitely when size is zero) in both web trees. It comes in transitively via postcss: web/frontend: postcss@8.5.24 -> nanoid@3.3.16 web/backend: vitest -> vite -> postcss@8.5.24 -> nanoid@3.3.16 Dependabot never raised an alert for it, so it would not have been fixed on its own. postcss@8.5.24 declares `nanoid: ^3.3.16`, and the fixed 3.3.18 already satisfies that range -- the lockfiles were simply pinned to 3.3.16 because that was the newest release when they were generated. So this is a plain `npm update nanoid`: two lockfile entries move, no package.json change and no `overrides` block needed. Impact was low to begin with: postcss and nanoid run only at build time (vite build / vitest) and nanoid never reaches the SPA bundle shipped in _ui_dist. This is hygiene, not an incident. Verified: `npm ci` succeeds in both trees, `npm run build` (`tsc -b && vite build`) passes in web/frontend, and `npm audit` reports 0 vulnerabilities in both. --- web/backend/package-lock.json | 6 +++--- web/frontend/package-lock.json | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/web/backend/package-lock.json b/web/backend/package-lock.json index ea0895a7..1525c31c 100644 --- a/web/backend/package-lock.json +++ b/web/backend/package-lock.json @@ -2094,9 +2094,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ { diff --git a/web/frontend/package-lock.json b/web/frontend/package-lock.json index 7b98856e..9262e2a4 100644 --- a/web/frontend/package-lock.json +++ b/web/frontend/package-lock.json @@ -4293,9 +4293,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ {