fix(security): update nanoid for CVE-2026-67214 - #1299
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR raises the required Nano ID version from ChangesNano ID security update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review exact current head |
|
|
|
@coderabbitai review Fresh review-only request for exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
head="b687150997dd81c4a60ca6199424f7a60c2beb90"
base="bf5870d9551773bf96b85294354a4d55fa9bf098"
echo "== checked-out and requested commits =="
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base "$base" "$head"
echo "== changed files =="
git diff --name-status "$base" "$head"
echo "== focused diff =="
git diff --check "$base" "$head"
git diff --unified=80 "$base" "$head" -- \
CHANGELOG.md \
backend/tests/test_frontend_nanoid_security.py \
pnpm-lock.yaml \
package.json \
pnpm-workspace.yaml
echo "== nanoid and postcss lock references at head =="
git grep -n -E 'nanoid@3\.3\.|nanoid:|postcss@8\.' "$head" -- \
pnpm-lock.yaml backend/tests/test_frontend_nanoid_security.py package.json pnpm-workspace.yaml || true
echo "== relevant test file outline and contents =="
test_file=$(fd -a '^test_frontend_nanoid_security\.py$' backend/tests | head -n1)
if [ -n "$test_file" ]; then
ast-grep outline "$test_file" --items all
sed -n '1,260p' "$test_file"
fi
echo "== pull request metadata and exact-head check runs =="
gh pr view 1299 --repo "$repo" --json number,headRefOid,baseRefOid,state,isDraft,mergeable,statusCheckRollup,url \
--jq '{number, url, state, isDraft, mergeable, headRefOid, baseRefOid, checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}]}'
echo "== workflow runs for requested head =="
gh run list --repo "$repo" --commit "$head" --limit 30 \
--json databaseId,name,status,conclusion,event,headSha,workflowName,url,createdAt,updatedAtLength of output: 32730 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
head="b687150997dd81c4a60ca6199424f7a60c2beb90"
base="bf5870d9551773bf96b85294354a4d55fa9bf098"
echo "== exact frontend lockfile diff =="
git diff --check "$base" "$head" -- frontend/pnpm-lock.yaml
git diff --unified=60 "$base" "$head" -- frontend/pnpm-lock.yaml
echo "== exact head: lock entries =="
git show "$head:frontend/pnpm-lock.yaml" \
| rg -n -C 8 '(^ nanoid@3\.3\.(17|18):|^ postcss@8\.5\.24:|nanoid: 3\.3\.(17|18))'
echo "== base: lock entries =="
git show "$base:frontend/pnpm-lock.yaml" \
| rg -n -C 8 '(^ nanoid@3\.3\.(17|18):|^ postcss@8\.5\.24:|nanoid: 3\.3\.(17|18))'
echo "== postcss-related change summary =="
git diff --word-diff=plain "$base" "$head" -- frontend/pnpm-lock.yaml \
| rg -n -C 4 'postcss|nanoid' || true
echo "== selected exact-head workflow runs and jobs =="
for run_id in 31319362372 31319362410 31319362337 31319362414 31319361154 31319362403; do
echo "-- run ${run_id} --"
gh run view "$run_id" --repo "$repo" --json databaseId,name,headSha,event,status,conclusion,jobs,url \
--jq '{databaseId,name,headSha,event,status,conclusion,url,jobs:[.jobs[]|{name,status,conclusion}]}'
doneLength of output: 19073
I reviewed exact head
The focused job-detail query returned a GitHub API 404. The earlier PR check and workflow-run queries independently confirmed each listed run as I did not modify, merge, publish, release, or weaken any gate. ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
RCA
Protected
developatbf5870d9551773bf96b85294354a4d55fa9bf098resolvespostcss@8.5.24 -> nanoid@3.3.17. The later GitHub advisoryGHSA-28wg-ghj8-5hjv/CVE-2026-67214classifies that version as vulnerable: the non-secure generators can loop indefinitely when an attacker supplies a negative size.The first failing production boundary is the protected frontend lock graph consumed by frozen installs. Immediate cause:
3.3.17fixed the earlier zero-size issue but predates the negative-size correction. Systemic control: the existing lock regression test asserted the earlier fixed floor as an exact version, so this PR advances that machine-checkable contract instead of adding a waiver or weakening the security gate.Minimal remedy
nanoid@3.3.17to the first fixed 3.x release,3.3.18;3.3.18;CHANGELOG.md.This preserves PostCSS and the 3.x compatibility surface. It does not introduce a 5.x override, change application behavior, alter workflow policy, or suppress Trivy/dependency-review/OSV evidence.
TDD and verification
RED on exact base:
backend/.venv/bin/python -m pytest -q backend/tests/test_frontend_nanoid_security.pyfailed because both lock sections still containednanoid@3.3.17.GREEN on candidate tree
ff282035f2e23679bc5b41783b7708f00523b005:38 passed;49 files / 427 tests passed;tsc --noEmit: passed;pnpm audit --prod --audit-level high: no known vulnerabilities;git diff --check: passed.The hosted exact-head Security Scan/Trivy, dependency review, OSV, SAST, application CI, and independent current-head review remain authoritative. Merge only if the unchanged head passes repository policy; queued, predecessor-head, stale-base, status-only, or synthetic-merge evidence is not acceptance.
Summary by CodeRabbit