From ec4cc66a073af4be229165fb128433482fa0b140 Mon Sep 17 00:00:00 2001
From: dude2k <7114997+dude2k@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:22:49 +0000
Subject: [PATCH] Fix frontend toolchain advisories

---
 CHANGELOG.md          |  4 ++++
 web/package-lock.json | 13 ++++++-------
 web/package.json      |  3 +++
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 49c8eb2..c218d31 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to MultiSpeed are documented here. The project follows [Sema
 
 ## [Unreleased]
 
+### Security
+
+- Override the build-time `js-yaml` dependency to 4.3.1 and update `nanoid` to 3.3.18 to address CPU-exhaustion advisories in the frontend toolchain.
+
 ## [1.2.0] - 2026-08-18
 
 ### Added
diff --git a/web/package-lock.json b/web/package-lock.json
index cc19c18..a6c4a8f 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -4318,9 +4318,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -4820,9 +4820,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.17",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
-      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
@@ -4830,7 +4830,6 @@
           "url": "https://github.com/sponsors/ai"
         }
       ],
-      "license": "MIT",
       "bin": {
         "nanoid": "bin/nanoid.cjs"
       },
diff --git a/web/package.json b/web/package.json
index 2d30bd8..ae46cfc 100644
--- a/web/package.json
+++ b/web/package.json
@@ -63,5 +63,8 @@
     "typescript-eslint": "8.67.0",
     "vite": "8.2.1",
     "vitest": "4.1.10"
+  },
+  "overrides": {
+    "js-yaml": "4.3.1"
   }
 }