From 89245a19fd6b6e7071fb19acb4ee5227b25b96d4 Mon Sep 17 00:00:00 2001 From: David Levi Date: Thu, 27 Aug 2026 00:31:13 +0000 Subject: [PATCH] chore: update nanoid to 3.3.18, clearing the last advisory Dependabot alert #6 states it "cannot update nanoid to a non-vulnerable version", naming @tailwindcss/postcss and next as conflicting dependencies. That is not correct, and the alert's own text contains the refutation. Both constraints are nanoid@^3.3.16. The caret range means >=3.3.16 <4.0.0, which admits 3.3.18. And 3.3.18 is published: the 3.x line runs to 3.3.18, carrying the "legacy" dist-tag. Nothing in the tree ever forbade it. The lockfile was simply pinned at 3.3.16 and no top-level bump existed to make Dependabot revisit it. Dependabot resolves a transitive advisory by looking for a release of the package that introduces it. Neither @tailwindcss/postcss nor next has published one that raises its own floor, so it reported the update as impossible. It is not impossible; it just is not reachable by the strategy Dependabot uses. `npm update nanoid --package-lock-only` moves the single lockfile entry from 3.3.16 to 3.3.18. Three lines. No package.json change, no dependency bump, and no `overrides` entry, which is what the alert suggested as the fallback. npm audit now reports 0 vulnerabilities, down from 1. Verified -------- Full install, lint, tsc --noEmit and build all clean. `npm run brand` writes fifteen files byte-identical to those committed, so the CI guard passes. npm audit reports zero. --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8202fd2..c8a1993 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5374,9 +5374,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github",