fix(deps): bump nanoid and brace-expansion past DoS advisories - #143
Open
shabaraba wants to merge 1 commit into
Open
fix(deps): bump nanoid and brace-expansion past DoS advisories#143shabaraba wants to merge 1 commit into
shabaraba wants to merge 1 commit into
Conversation
Pin patched floors via pnpm.overrides and refresh the lockfile (transitive dependencies): - CVE-2026-67214: nanoid >= 3.3.16 - CVE-2026-69152: brace-expansion >= 1.1.18 / 2.1.4 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR addresses dependency-scanner DoS advisories by adding pnpm.overrides to enforce patched minimum versions for transitive dependencies (nanoid and brace-expansion) and updating the lockfile so the resolved graph no longer includes vulnerable versions.
Changes:
- Add
pnpm.overridesinpackage.jsonto enforce patched version floors fornanoid@^3andbrace-expansion@^1/^2. - Refresh
pnpm-lock.yamlto reflect the overrides and updated resolved versions (nanoid→ 3.3.18,brace-expansion→ 1.1.18 / 2.1.4).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds pnpm.overrides to enforce patched transitive dependency floors. |
| pnpm-lock.yaml | Updates the resolved dependency graph to remove vulnerable nanoid / brace-expansion versions and records overrides in the lockfile. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+34
to
+40
| "packageManager": "pnpm@10.28.2", | ||
| "pnpm": { | ||
| "overrides": { | ||
| "nanoid@^3": ">=3.3.16 <4", | ||
| "brace-expansion@^1": ">=1.1.18 <2", | ||
| "brace-expansion@^2": ">=2.1.4 <3" | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
These transitive dependencies had known DoS advisories. Bumping them to patched
versions removes the vulnerable code paths and clears dependency scanner alerts.
nanoid/non-secure): infinite loop on a negativesizeargument.intermediate arrays.
What
Add
pnpm.overridespinning patched floors and refresh the lockfile(lockfile-only; no source changes). Both packages are transitive:
nanoid@^3:>=3.3.16 <4(kept on the 3.x / CJS line) → 3.3.18brace-expansion@^1:>=1.1.18 <2→ 1.1.18brace-expansion@^2:>=2.1.4 <3→ 2.1.4How to test
Lockfile-only change. Verified no vulnerable
nanoid/brace-expansionversionremains in
pnpm-lock.yaml. Relying on CI to confirm the graph still resolvesand builds (not run locally).
Checklist