From 94ea55177a25688deffa2021ca4cefdac5e58ff6 Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Mon, 17 Aug 2026 14:51:16 -0500 Subject: [PATCH] fix(deps): take the nanoid patch that is failing the audit gate The gate has been red since at least 2026-08-13, and only on `audit`: GATE FAILED: - audit Everything else passed - the probe suite included, 3 of 3 caught. The single finding is GHSA-2v37-7h3g-55p8, high severity: nanoid's custom generators can loop indefinitely when size is zero. nanoid is transitive (via vite), so there is no direct dependency to bump; `npm audit fix` resolves it inside the lock file alone. nanoid 3.3.16 -> 3.3.18. Three lines, one package, nothing else moved. This is the same advisory that was blocking the sibling ToDoApp frontend, fixed there by ToDoApp#123. Blocks #41 and #43: both are dependency bumps that cannot be merged while a required gate is failing for a reason unrelated to either of them. Verified locally: npm audit reports 0 vulnerabilities, typecheck is clean, and all 498 tests across 49 files pass. Note the suite must be run from a path with no '#' character - Vite refuses to resolve a project root containing one, which fails all 49 files for reasons that have nothing to do with the code. Co-authored-by: Claude Opus 5 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index c25dfd7..14d1804 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1370,9 +1370,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ {