fix(deps): bump nanoid past the indefinite-loop advisory - #3466
Conversation
Security Audit fails on main. The Deno dependency scan is clean; the failure is `npm --prefix storybook audit`, which reports nanoid 3.3.16 against GHSA-2v37-7h3g-55p8 (high): custom generators can loop indefinitely when size is zero. nanoid is transitive, so this is `npm update nanoid --package-lock-only` rather than a manifest change. 3.3.16 to 3.3.18. npm also drops the hoisted top-level @emnapi/core and @emnapi/runtime entries. That is correct rather than collateral: `npm update nanoid` alone produces the same removal, so the committed lockfile was carrying stale hoists. Their only dependents -- @tailwindcss/oxide-wasm32-wasi and @napi-rs/wasm-runtime -- are optional dev platform packages for wasm32-wasi, and the copies that are actually reachable live nested under @oxc-parser and @oxc-resolver. `npm ls @emnapi/core` resolves cleanly. Verified: `deno task audit`, the exact task CI runs, exits 0 and reports no vulnerabilities from either scanner.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e1295724f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The previous commit used `npm update nanoid --package-lock-only`, which recomputed the whole tree and dropped the hoisted top-level @emnapi/core and @emnapi/runtime records. `npm ci` -- what the npm-install-smoke job actually runs -- then fails with EUSAGE, reporting both as missing from the lock file, before any smoke check executes. I had checked that removal with `npm ls @emnapi/core`, which exits 0 because it only resolves what is reachable. `npm ci` additionally requires the lockfile to satisfy every declared dependency, including peers of optional platform packages, so it was the wrong instrument for the question. nanoid is transitive under postcss, whose range is ^3.3.16, so 3.3.18 satisfies it without any structural change. This edits that single entry's version, resolved URL and integrity, leaving the tree exactly as main has it. Verified against main as a control on the same toolchain: `npm --prefix storybook ci --ignore-scripts` exits 0 on main, exited 1 with the regenerated lockfile, and exits 0 again here, installing nanoid 3.3.18. `deno task audit` reports no vulnerabilities from either scanner.
2 participants
Security Audit is failing on
main. Not caused by any of today's changes — it fails on push.The Deno dependency scan is clean (
✅ No vulnerabilities found, 77 deps). The failure is the second half of the task,npm --prefix storybook audit:Change
nanoid is transitive, so this is
npm update nanoid --package-lock-onlyrather than a manifest change. 3.3.16 → 3.3.18.npm also drops the hoisted top-level
@emnapi/coreand@emnapi/runtimeentries. I checked this rather than assuming it was collateral fromaudit fix:npm update nanoidalone produces the identical removal, so the committed lockfile was carrying stale hoists.Their only dependents —
@tailwindcss/oxide-wasm32-wasiand@napi-rs/wasm-runtime— areoptional: true, dev: trueplatform packages for wasm32-wasi, and the reachable copies live nested under@oxc-parserand@oxc-resolver.npm ls @emnapi/coreexits 0 and resolves cleanly.Verification
deno task audit— the exact task CI runs — exits 0, with both scanners reporting no vulnerabilities.