fix(security): update transitive nanoid for CVE-2026-67213

[seonghobae]

RCA

The shared protected develop dependency graph resolved postcss@8.5.24 -> nanoid@3.3.16. GitHub Security Scan/Trivy reports CVE-2026-67213 (GHSA-2v37-7h3g-55p8): customAlphabet and customRandom can spin indefinitely when an attacker-controlled size is zero.

The exact protected base at branch creation is 5425ce4f55b2cf16b2c82a4fd661c9d0bd0660c7.

Root cause and minimal remedy

GitHub's reviewed advisory identifies 3.3.17 as the first patched 3.x release. PostCSS's compatible range accepts it, so this PR changes only the transitive lock resolution and adds a fail-closed regression test. It preserves postcss@8.5.24; it does not add a waiver, VEX, ignore, severity reduction, 5.x override, or unrelated package upgrade.

TDD evidence

Test-only head a70b78d662c0c127a1f2b73e6bf18370a7a14882 was RED because both lock sections resolved nanoid@3.3.16.

Exact GREEN head: d92f85e8fe0d80708a11516ee0bab0019e180ca4.

Local verification on the exact candidate tree:

• PYTHONWARNINGS=error DISABLE_BACKGROUND_WORKERS=1 python -m pytest backend/tests/test_frontend_nanoid_security.py -q — 1 passed
• proxy-neutral PYTHONWARNINGS=error DISABLE_BACKGROUND_WORKERS=1 python -m pytest backend -q — 1694 passed, 33 skipped
• python -m ruff check backend/tests/test_frontend_nanoid_security.py — passed
• corepack pnpm@11.5.3 --dir frontend install --frozen-lockfile --ignore-scripts — lock and supply-chain policy passed
• corepack pnpm@11.5.3 --dir frontend test — 49 files / 427 tests passed
• corepack pnpm@11.5.3 --dir frontend lint — passed
• POSTCSS_WORKERS=1 DISABLE_POSTCSS_WORKERS=true corepack pnpm@11.5.3 --dir frontend build — passed
• corepack pnpm@11.5.3 --dir frontend audit --prod --audit-level high — no known vulnerabilities
• git diff --check — passed

Local Trivy is not installed; the required hosted exact-head Security Scan/Trivy result remains the authority and must pass before merge.

Acceptance

Merge only after current-head CI, Security Scan/Trivy, SAST, container/release governance, and robot-review evidence are complete. No predecessor-head, queued, skipped-required, status-only evidence, waiver, or admin bypass counts as acceptance.

Summary by CodeRabbit

• Tests
  • Added automated security checks to ensure the frontend dependency lockfile uses the patched Nano ID version consistently.
  • Added validation that PostCSS resolves Nano ID to the approved secure version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ac623570-6d96-46ed-8087-ce97fc60bf10

📥 Commits

Reviewing files that changed from the base of the PR and between 5425ce4 and d92f85e.

⛔ Files ignored due to path filters (1)

• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• backend/tests/test_frontend_nanoid_security.py

---

📝 Walkthrough

Walkthrough

The PR adds a backend test that parses the frontend pnpm lockfile. The test requires Nano ID 3.3.17 in package and snapshot entries and verifies PostCSS uses that version.

Changes

Nano ID lockfile security

Layer / File(s)	Summary
Validate patched Nano ID resolution backend/tests/test_frontend_nanoid_security.py	The test checks Nano ID 3.x entries in both lockfile sections and verifies PostCSS resolves Nano ID to 3.3.17.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• ContextualWisdomLab/noema#75 — The test validates the same Nano ID 3.3.17 lockfile remediation and PostCSS transitive dependency resolution.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the transitive Nano ID security update for the specified CVE.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nanoid-cve-2026-67213

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate update for d92f85e8fe0d80708a11516ee0bab0019e180ca4: no current blocking failures remain.

PR governance metadata gate is ready; all current-head requirements passed.