From 7fc407b16e9915959a283bfb9bd614c8381c5f3c Mon Sep 17 00:00:00 2001 From: James Rich <2199651+jamesarich@users.noreply.github.com> Date: Sat, 22 Aug 2026 12:29:51 -0500 Subject: [PATCH] fix(web-ui): bump transitive nanoid to 3.3.18, patches CVE-2026-67213 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit nanoid < 3.3.18 has an infinite loop in customAlphabet/customRandom when called with size=0 (GHSA-2v37-7h3g-55p8, Dependabot alert #24). Pulled in transitively by postcss (^3.3.16, already satisfied by 3.3.18 — no other package.json/lockfile changes needed). Signed-off-by: James Rich Signed-off-by: James Rich <2199651+jamesarich@users.noreply.github.com> --- web-ui/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/web-ui/package-lock.json b/web-ui/package-lock.json index 441483f..d7a0268 100644 --- a/web-ui/package-lock.json +++ b/web-ui/package-lock.json @@ -1912,9 +1912,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github",