From 21dae47da030ed34a9b90ed35f38edccb8a22742 Mon Sep 17 00:00:00 2001 From: Si Hyeong Lee Date: Tue, 18 Aug 2026 15:21:08 -0700 Subject: [PATCH] fix(deps): take nanoid 3.3.18 past GHSA-2v37-7h3g-55p8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A newly published high-severity advisory covers nanoid < 3.3.18, which is a different one from the y-indexeddb advisory pinned in #26 and arrives by a different path — postcss, not Keystatic. No override this time. postcss already asks for ^3.3.16, so the patch was always in range and only the lockfile was holding 3.3.17. The three-line lockfile bump is the whole fix, and adding an override here would have left a permanent pin behind for a problem npm can resolve on its own. npm audit reports 0 vulnerabilities; the audit-level=high CI gate exits 0 again. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LaydoxAZ4eaqqPNKrmWLbt --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3a091b2..ef1b0ec 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11208,9 +11208,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.17", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", - "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github",