Skip to content

chore(deps): bump nanoid to 3.3.18 to clear the high-severity advisory - #2061

Merged
cliffhall merged 1 commit into
v2/mainfrom
v2/chore/2058-nanoid-advisory
Aug 19, 2026
Merged

chore(deps): bump nanoid to 3.3.18 to clear the high-severity advisory#2061
cliffhall merged 1 commit into
v2/mainfrom
v2/chore/2058-nanoid-advisory

Conversation

@cliffhall

@cliffhall cliffhall commented Aug 19, 2026

Copy link
Copy Markdown
Member

Closes #2058

Lockfile-only security bump: nanoid 3.3.16 → 3.3.18 in all five installs, clearing GHSA-2v37-7h3g-55p8 (high). npm audit --omit=dev is now clean at the root and in each of the four client installs.

The advisory is transitive — vitepostcssnanoid — and postcss depends on nanoid@^3.3.11, so the fix is a plain in-range lockfile bump. No package.json changed.

Scope note — this PR shrank after merging v2/main

It was opened against a tree with 8 outstanding advisories (4 high) and fixed all of them. #2059 (for #2057) then landed on v2/main and covered seven of the eight — undici, hono, fast-uri, ip-address, qs, express-rate-limit, body-parser — deliberately leaving nanoid to this issue.

After merging v2/main in, the net diff is therefore exactly what #2058 asked for: nanoid in five lockfiles, plus the README paragraph below. The conflicted lockfiles were resolved by taking v2/main's side wholesale and re-deriving the nanoid bump on top, rather than hand-splicing JSON — so nothing from #2059 is silently reverted. Verified: the only difference from origin/v2/main in any lockfile is the one nanoid entry.

Why targeted npm update, not npm audit fix

npm audit fix reaches a clean audit but re-resolves the whole tree, and here it dragged in an esbuild downgrade, 0.27.7 → 0.27.2, across web/cli/tui — ~700 lines of lockfile noise for a one-package security patch. Each install got a targeted npm update nanoid instead.

vite in dependencies — checked, and correct as-is

The issue flagged this as worth a look, since vite sitting in root dependencies is why this advisory showed under --omit=dev at all. It is deliberate, not a misplacement:

  • clients/web/server/start-vite-dev-server.ts imports vite and @vitejs/plugin-react at runtime for mcp-inspector --web --dev.
  • clients/web/tsup.runner.config.ts lists both as external, so the published runner bundle doesn't carry them — a consumer install resolves them from the root manifest.
  • devDependencies aren't installed for consumers, so moving them would break --web --dev (and the on-demand vite build in ensure-web-build.ts) while passing every local check — exactly the failure mode AGENTS.md's placement rule warns about.

Left in place, with the reasoning added to the README's dependency-placement paragraph so it doesn't have to be re-derived. Them showing up under --omit=dev is correct: they genuinely are in the production tree.

Verification

  • npm audit --omit=devfound 0 vulnerabilities at the root and in clients/{web,cli,tui,launcher}.
  • npm run ci passes.

No UI change, so no screenshots.

@cliffhall cliffhall added the v2 Issues and PRs for v2 label Aug 19, 2026
@cliffhall cliffhall changed the title chore: clear all npm audit advisories in the production tree chore(deps): bump nanoid to 3.3.18 to clear the high-severity advisory Aug 19, 2026
`npm audit --omit=dev` reported one high-severity finding in the
production tree, on both `main` and `v2/main`:

  nanoid <3.3.18 — GHSA-2v37-7h3g-55p8
  custom generators can loop indefinitely when size is zero

It arrives transitively, via vite -> postcss -> nanoid. `postcss`
depends on `nanoid@^3.3.11`, so the fix is an in-range lockfile bump in
all five installs — no package.json changed. `npm audit --omit=dev` is
now clean at the root and in each of the four client installs.

Applied as a targeted `npm update nanoid` per install rather than
`npm audit fix`. The latter reaches the same clean audit but re-resolves
the whole tree, and here dragged in an unrelated esbuild downgrade
(0.27.7 -> 0.27.2) across web/cli/tui — roughly 700 lines of lockfile
noise for a one-package security patch.

The issue also asked whether `vite` belongs in root `dependencies`,
since that placement is why this advisory appears under `--omit=dev` at
all. It does, and deliberately: `start-vite-dev-server.ts` imports
`vite` and `@vitejs/plugin-react` at runtime for `--web --dev`, and
`tsup.runner.config.ts` lists both as `external`, so a published install
resolves them from the root manifest. Moving them to `devDependencies`
would break `--web --dev` for consumers while passing every local check.
Left in place, with the reasoning recorded in the README's
dependency-placement paragraph so it need not be re-derived.

Verified: `npm audit --omit=dev` reports 0 vulnerabilities in all five
installs; `npm run ci` passes.

Signed-off-by: cliffhall <cliff@futurescale.com>
@cliffhall
cliffhall force-pushed the v2/chore/2058-nanoid-advisory branch from b8eded4 to 180b397 Compare August 19, 2026 03:12
@cliffhall
cliffhall merged commit 471b865 into v2/main Aug 19, 2026
3 checks passed
@cliffhall
cliffhall deleted the v2/chore/2058-nanoid-advisory branch August 19, 2026 03:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v2 Issues and PRs for v2

Projects

None yet

Development

Successfully merging this pull request may close these issues.

High-severity nanoid advisory in the production tree (via vite → postcss), on both branches

1 participant