From a0f57fc3b71f93684b3f36b41420aa5a6e932340 Mon Sep 17 00:00:00 2001 From: Dominik Ferber Date: Wed, 12 Aug 2026 11:11:12 +0300 Subject: [PATCH] chore: override nanoid@3 to fix Dependabot alert `hypertune` and `@vercel/microfrontends` resolved to nanoid 3.3.16, which is vulnerable to an infinite loop when a custom generator is called with size zero. The existing `nanoid@>=4` override did not cover the v3 range, so add a matching `nanoid@3: ^3.3.18` override. Co-Authored-By: Claude Opus 5 (1M context) --- package.json | 1 + pnpm-lock.yaml | 18 ++++++------------ 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/package.json b/package.json index fff9426f..58ce3b66 100644 --- a/package.json +++ b/package.json @@ -73,6 +73,7 @@ "js-yaml@3": "^3.15.1", "js-yaml@4": "^4.3.1", "mermaid": "^11.16.1", + "nanoid@3": "^3.3.18", "nanoid@>=4": "^5.1.16", "@sveltejs/kit": "^2.70.2" } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 243b012e..0f14faa9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -23,6 +23,7 @@ overrides: js-yaml@3: ^3.15.1 js-yaml@4: ^4.3.1 mermaid: ^11.16.1 + nanoid@3: ^3.3.18 nanoid@>=4: ^5.1.16 '@sveltejs/kit': ^2.70.2 @@ -8039,11 +8040,6 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} - engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} - hasBin: true - nanoid@3.3.18: resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} @@ -14316,7 +14312,7 @@ snapshots: http-proxy: 1.18.1 jsonc-parser: 3.3.1 md5: 2.3.0 - nanoid: 3.3.16 + nanoid: 3.3.18 path-to-regexp: 6.3.0 semver: 7.7.4 optionalDependencies: @@ -14341,7 +14337,7 @@ snapshots: http-proxy: 1.18.1 jsonc-parser: 3.3.1 md5: 2.3.0 - nanoid: 3.3.16 + nanoid: 3.3.18 path-to-regexp: 6.3.0 semver: 7.7.4 optionalDependencies: @@ -14366,7 +14362,7 @@ snapshots: http-proxy: 1.18.1 jsonc-parser: 3.3.1 md5: 2.3.0 - nanoid: 3.3.16 + nanoid: 3.3.18 path-to-regexp: 6.3.0 semver: 7.7.4 optionalDependencies: @@ -14391,7 +14387,7 @@ snapshots: http-proxy: 1.18.1 jsonc-parser: 3.3.1 md5: 2.3.0 - nanoid: 3.3.16 + nanoid: 3.3.18 path-to-regexp: 6.3.0 semver: 7.7.4 optionalDependencies: @@ -16376,7 +16372,7 @@ snapshots: joycon: 3.1.1 json-stable-stringify: 1.3.0 jsonito: 0.2.3 - nanoid: 3.3.16 + nanoid: 3.3.18 p-retry: 4.6.2 regenerator-runtime: 0.14.1 transitivePeerDependencies: @@ -17609,8 +17605,6 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.16: {} - nanoid@3.3.18: {} nanoid@5.1.16: {}