fix(deps): pin nanoid past GHSA-28wg-ghj8-5hjv under y-indexeddb - #26
Merged
Conversation
npm audit --audit-level=high is a CI gate, so a newly published high-severity advisory fails every open PR regardless of what the PR changes. This is the second time in a week; the branch that trips it is never the branch that caused it. nanoid 4.0.0–5.1.15 lets a non-secure generator loop forever on a negative size. It reaches us once, transitively: @keystatic/core → @toeverything/y-indexeddb → nanoid@5.1.6. Fixed in 5.1.16. The override is scoped to that path rather than global on purpose. A bare "nanoid": "^5.1.16" also captures the copy under postcss, which is pinned to ^3 and is not in the affected range — forcing a major on it to fix a package it has nothing to do with. After this, npm ls shows y-indexeddb on 5.1.16 and postcss still on 3.3.17, which is the whole point. npm audit clean, type-check, lint, 161 tests, production build. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LaydoxAZ4eaqqPNKrmWLbt
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
writingdeveloper
added a commit
that referenced
this pull request
Aug 19, 2026
A newly published high-severity advisory covers nanoid < 3.3.18, which is a different one from the y-indexeddb advisory pinned in #26 and arrives by a different path — postcss, not Keystatic. No override this time. postcss already asks for ^3.3.16, so the patch was always in range and only the lockfile was holding 3.3.17. The three-line lockfile bump is the whole fix, and adding an override here would have left a permanent pin behind for a problem npm can resolve on its own. npm audit reports 0 vulnerabilities; the audit-level=high CI gate exits 0 again. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LaydoxAZ4eaqqPNKrmWLbt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks CI. Nothing to do with any feature branch —
npm audit --audit-level=highis a gate, so a newly published advisory fails every open PR at once. Second time in a week.The chain
nanoid4.0.0–5.1.15: a non-secure generator can loop indefinitely on a negative size (GHSA-28wg-ghj8-5hjv). It reaches this repo once, transitively:Fixed in 5.1.16.
Why the override is scoped
A bare
"nanoid": "^5.1.16"would also capture the other copy in the tree —@tailwindcss/postcss → postcss → nanoid@3.3.17— which is not in the affected range and expects^3. That would force a major bump on a package with no part in this, to fix a bug it does not have.After the change:
Verification
npm audit --audit-level=high→ 0 vulnerabilities. Type-check, lint, 161 tests, production build all pass on a clean.next.🤖 Generated with Claude Code
https://claude.ai/code/session_01LaydoxAZ4eaqqPNKrmWLbt