fix(deps): take the nanoid patch that unblocks the frontend queue - #123
Merged
Conversation
deploy.yml gates on `npm audit --audit-level=high`, and it has been failing since 2026-08-08 on a real advisory: nanoid 3.3.16 (via postcss 8.5.25, which requires ^3.3.16) GHSA-2v37-7h3g-55p8 - high - custom generators can loop indefinitely when size is zero - patched in 3.3.18 Every open Dependabot pull request on this branch is held behind it. The gate is correct and the finding is real; nothing had rebuilt the lock file to collect the fix, exactly as nothing had rebuilt the container to collect CVE-2026-62901. postcss already accepts ^3.3.16, so 3.3.18 satisfies the existing range and nothing else moves. Three lines, lock file only, no package.json change. Applied by hand rather than by `npm audit fix`. That command makes the same nanoid change, but the npm here (11.x on node 24) also stripped `libc` fields from six optional platform-specific packages - metadata that selects between glibc and musl builds of native binaries. Unrelated churn riding inside a security fix is how a platform-resolution bug arrives unnoticed, so the nanoid block was patched on its own and the integrity hash checked against registry.npmjs.org rather than taken from local output. Verified: `npm ci` clean, `npm audit --audit-level=high` exits 0, `npm run build` succeeds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://salmon-field-054249810-123.centralus.7.azurestaticapps.net |
bgard68
added a commit
that referenced
this pull request
Aug 17, 2026
Every Dependabot pull request on this branch has been permanently unmergeable, and would have stayed that way. The deploy step already skipped forks, on the correct reasoning that secrets are not exposed to them and the deploy would "fail confusingly rather than meaningfully". Dependabot is the same problem wearing a different hat: its pull requests run with a restricted token and no access to repository secrets, whatever branch they sit on. Those branches are in this repository, so the fork test passed, the step ran, and the action stopped with: deployment_token was not provided. Build & Deploy Frontend is a required check, so that failure blocked the merge with no way to clear it - not a stale result, not something a rebase or a re-run could fix. #123 passing the same check on the same code is the control: that branch was not Dependabot's, so the secret was there. Keyed on the pull request author rather than github.actor, because re-running a Dependabot workflow by hand makes the actor a human while the token stays restricted. Everything that gates quality still runs on those pull requests: npm ci, the audit at --audit-level=high, the frontend tests, the CSP connect-src check, and the docs drift check. Only the upload is skipped, and it could not have succeeded. Pushes to this branch and ordinary same-repo pull requests deploy exactly as before. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks every open Dependabot pull request on
frontend. Three lines, lock file only.The finding
deploy.ymlgates onnpm audit --audit-level=high, and it has been failing since 2026-08-08 on a genuine advisory:The gate is correct and the finding is real. Nothing had rebuilt the lock file to collect the fix — the same shape of problem as the base image in #116, where Microsoft had already shipped the patch and nothing was rebuilding to pick it up.
postcssalready accepts^3.3.16, so 3.3.18 satisfies the existing range. Nothing else moves, andpackage.jsonis unchanged.Applied by hand, deliberately
npm audit fixmakes the samenanoidchange — but the npm available here (11.x on node 24) also strippedlibcfields from six optional platform-specific packages:That metadata selects between glibc and musl builds of native binaries. Unrelated churn riding inside a security fix is how a platform-resolution bug arrives unnoticed, so that was reverted and only the
nanoidblock patched. The integrity hash was checked againstregistry.npmjs.orgrather than taken from local output:Verification
Combined with #122, which fixes the
codeql-actionthree-way version split on this branch, this should let #104 and #105 go green on their own.🤖 Generated with Claude Code