From f7ac03fd89c05b32a58d40f313dfec14f3982b19 Mon Sep 17 00:00:00 2001 From: Rex Zhou Date: Tue, 15 Sep 2026 08:59:08 +0100 Subject: [PATCH] fix(deps): bump nanoid to 3.3.19 (CVE-2026-67213) Fixes Dependabot alert #269 (GHSA-2v37-7h3g-55p8). nanoid before 3.3.18 can loop indefinitely in customAlphabet/customRandom when size is 0. Transitive via postcss (vite). Lockfile-only; no direct dependency change. --- browser/flagr-ui/package-lock.json | 6 +++--- docs/package-lock.json | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/browser/flagr-ui/package-lock.json b/browser/flagr-ui/package-lock.json index 24430896..2a46ed53 100644 --- a/browser/flagr-ui/package-lock.json +++ b/browser/flagr-ui/package-lock.json @@ -3362,9 +3362,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.19", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz", + "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==", "funding": [ { "type": "github", diff --git a/docs/package-lock.json b/docs/package-lock.json index 56cf7d21..c7839c9f 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -2841,9 +2841,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.17", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", - "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", + "version": "3.3.19", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz", + "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==", "dev": true, "funding": [ {