From 005bbf134c36db0c32bb38d54e1ebceaa25704b2 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Fri, 7 Aug 2026 18:20:01 -0700
Subject: [PATCH 1/2] chore: adopt the shared renovate preset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Renovate is installed org-wide, and this repo had no config — so it was getting
an onboarding PR carrying Renovate's stock posture rather than the org's.

This adopts the shared preset instead:

    { "extends": ["github>nanohype/.github"] }

which brings the reviewed posture: patch and minor open a PR rather than
automerging, majors are labelled for review, CVE-triggered updates are excluded
from automerge twice over, GitHub Actions are grouped and pinned to commit SHAs,
and related packages move together so a split PR cannot land half an upgrade.

What there is to manage here: the pnpm workspace, tofu, and the actions in 2 workflows
---
 renovate.json | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..01564bd
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>nanohype/.github"]
+}

From 1dc46ae20cc03cb80222b2cef1e569d8b29d9a62 Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Fri, 7 Aug 2026 18:34:53 -0700
Subject: [PATCH 2/2] fix: nanoid CVE fails the osv-scanner gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

postcss pulls nanoid 3.3.16, which carries GHSA-2v37-7h3g-55p8 (CVSS 8.2) —
custom generators can loop indefinitely when size is zero. The build workflow
runs osv-scanner over pnpm-lock.yaml, so this was failing every PR, not just
this one.

Pinned with a pnpm override alongside the three already there, in the same shape
postcss and fast-uri use.

The constraint is ^3.3.17, not >=3.3.17: the open-ended form resolves to
nanoid 6, which is ESM-only and is not the API postcss calls. The caret keeps
the fix inside the 3.x line the parent supports.

Third repo with this same advisory today, after nanohype's six lockfiles and
portal's web lockfile. Nothing looks across repos for a shared advisory, which
is part of why the org is adopting Renovate — osvVulnerabilityAlerts would have
raised all of them on their own.
---
 package.json   | 1 +
 pnpm-lock.yaml | 9 +++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index c2b4765..09009e6 100644
--- a/package.json
+++ b/package.json
@@ -34,6 +34,7 @@
   "pnpm": {
     "overrides": {
       "postcss": ">=8.5.18",
+      "nanoid": "^3.3.17",
       "fast-uri": ">=4.1.2",
       "js-yaml@4": "^4.3.1"
     }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 57f1686..9cea617 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,6 +6,7 @@ settings:
 
 overrides:
   postcss: '>=8.5.18'
+  nanoid: ^3.3.17
   fast-uri: '>=4.1.2'
   js-yaml@4: ^4.3.1
 
@@ -1796,8 +1797,8 @@ packages:
   muggle-string@0.4.1:
     resolution: {integrity: sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ==}
 
-  nanoid@3.3.16:
-    resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -4680,7 +4681,7 @@ snapshots:
 
   muggle-string@0.4.1: {}
 
-  nanoid@3.3.16: {}
+  nanoid@3.3.18: {}
 
   neotraverse@1.0.1: {}
 
@@ -4787,7 +4788,7 @@ snapshots:
 
   postcss@8.5.23:
     dependencies:
-      nanoid: 3.3.16
+      nanoid: 3.3.18
       picocolors: 1.1.1
       source-map-js: 1.2.1