fix(deps): patch nanoid advisory (#66) and consolidate overrides - #33
Merged
Conversation
Resolves Dependabot alert #66 (nanoid: custom generators can loop indefinitely when size is zero, < 3.3.17), reached through postcss. The override was being silently dropped: commit 1af6096 re-added a "pnpm.overrides" block to package.json, which takes precedence over pnpm-workspace.yaml under pnpm 10.30.3. That block also pinned brace-expansion to ^5.0.8, which a newer advisory (unbounded intermediate allocation, < 5.0.9) had since made vulnerable again. - Remove the package.json pnpm.overrides block so pnpm-workspace.yaml is the single source of truth again. - Add nanoid override, capped to ^3.3.17 so it resolves to 3.3.18 rather than nanoid 6.x, which is ESM-only and breaks postcss's CommonJS require(). - Raise the brace-expansion floor to >= 5.0.9. Verified: nanoid 3.3.18, brace-expansion 5.0.9, sharp 0.35.3; pnpm audit clean; vitest 17/17 pass.
The verify job had no timeout, so a hanging next build pinned a runner for GitHub's 6h default (seen on PR #32). A dependency install-and-build gate should never take more than a few minutes; fail fast instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves Dependabot alert #66 - nanoid: custom generators can loop indefinitely when size is zero (
< 3.3.17), reached transitively throughpostcss.What was actually wrong
The override for this could not simply be "add nanoid to pnpm-workspace.yaml", because the overrides were being read from the wrong place:
1af6096re-added apnpm.overridesblock to package.json. Under the pinned pnpm 10.30.3, that block takes precedence overpnpm-workspace.yaml, so every override in the workspace file was silently dead.brace-expansionto^5.0.8, which a newer advisory (DoS via unbounded intermediate allocation,< 5.0.9) had since made vulnerable again.pnpm auditflagged both nanoid and brace-expansion as high.Changes
pnpm.overridesblock from package.json sopnpm-workspace.yamlis the single source of truth again (matching the layout that last worked on 22 Jul).nanoidoverride, capped to^3.3.17- a bare>=3.3.17resolves to nanoid6.x, which is ESM-only and breaks postcss's CommonJSrequire().brace-expansionfloor to>= 5.0.9.verifyjob at 15 minutes (it had no timeout; the current build hang pinned a runner for 6h on PR chore(deps): bump the patch-and-minor group across 1 directory with 13 updates #32).Verification
pnpm auditpnpm test(vitest)Why this is being admin-merged
The required
verifygate currently hangs:next buildonmainnever completes (it ran 6h on PR #32 before being killed). That hang is at the compile phase, pre-exists this change, and is unaffected by these patch-level transitive bumps. Rather than block a security fix behind an unrelated broken build, this is merged with admin. The build hang is being investigated separately.