chore(deps): bump nanoid to 3.3.19 (Dependabot #269, no runtime impact) - #780
Merged
Merged
Conversation
Fixes Dependabot alert #269 (GHSA-2v37-7h3g-55p8). nanoid before 3.3.18 can loop indefinitely in customAlphabet/customRandom when size is 0. Transitive via postcss (vite). Lockfile-only; no direct dependency change.
|
Tick the box to add this pull request to the merge queue (same as
|
zhouzhuojie
changed the title
marceloboeira
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Lockfile-only bump of transitive
nanoidfrom 3.3.16 (UI) / 3.3.17 (docs) to 3.3.19 so Dependabot alert #269 can close.The advisory is CVE-2026-67213 / GHSA-2v37-7h3g-55p8:
customAlphabet/customRandomcan loop forever whensizeis 0. That is only a problem if an app forwards an untrusted size into those APIs.Impact in Flagr is negligible. The Go server does not use
nanoid. In the UI/docs it is a Vite → PostCSS build-time dependency. PostCSS callsnanoid/non-securewith a hardcoded length of 6 to label CSS inputs during build/dev — notcustomAlphabet/customRandom, and not on any request path. This does not ship as a user-facing ID API in the UI bundle.This is hygiene so the high-severity scanner finding goes away; it is not a reachable DoS on the Flagr API or admin UI.
Fixes https://github.com/openflagr/flagr/security/dependabot/269
Motivation and Context
Open Dependabot alert #269 (high) on
browser/flagr-ui/package-lock.json. The docs lockfile was still on 3.3.17 (< 3.3.18), so it is updated in the same PR.How Has This Been Tested?
make flagr-ui-check(lint, typecheck, Vitest — 14 files / 91 tests passed)make build-docs(VitePress production build succeeded)Types of changes
Checklist: