From 99c982360a8a8b7fa54f266e050d0f07e6eba50e Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 8 Aug 2026 03:26:22 +0000 Subject: [PATCH] =?UTF-8?q?fix(deps):=20nanoid=20=E9=A1=B6=E5=88=B0=203.3.?= =?UTF-8?q?x=20=E8=A1=A5=E4=B8=81=E7=BA=BF=EF=BC=8C=E6=B8=85=E6=8E=89=20GH?= =?UTF-8?q?SA-2v37-7h3g-55p8=20(#6529)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OSV 门在锁文件上变红，因此对每一个 open PR 都生效，与各 PR 的改动内容无关。 本地以 osv-scanner v2.3.8（与 CI action 同版本）、同样的 `--lockfile=pnpm-lock.yaml` 参数复现：1387 个包，1 条 High（8.2）—— nanoid 3.3.16 命中 GHSA-2v37-7h3g-55p8 / CVE-2026-67213（自定义字母表在 size 为零时无限循环， 即拒绝服务），退出码 1。 公告带**两条**受影响区间：introduced:0 → fixed:3.3.17，以及 introduced:4.0.0 → fixed:5.1.6。此处只有第一条是活的：3.3.16 唯一由 postcss@8.5.25 间接引入（全锁文件仅一条 `nanoid:` 边），而四个 driver 直接声明的 nanoid ^6.0.0 高于第二条的修复线，本就不受影响。 上界按 AGENTS.md 与本块头部规则落在 target 之上的 **major 边界**（4.0.0）， ⛔ 不写成 `<3.3.17` —— 那个形状会在 3.3.17 自己出公告那天当场失配 （undici 7.28.0 / brace-expansion 5.0.8 的活体标本，#4961 / #5032）。 `<4.0.0` 同时把 6.x 挡在选择器之外，正是它该待的地方。 ^3.3.17 落在 postcss 自己声明的 ^3.3.16 区间内，所以这是往补丁线上的一次 dedupe，而不是把 postcss 顶过它支持的范围。 解析版本位移实测：1387 个 packages 键 + 1387 个 snapshots 键 + 746 条 importer 边，逐一比对，**只有 nanoid 3.3.16 → 3.3.18 一处**（^3.3.17 在 3.x 内浮到最新，即 npm 的 legacy dist-tag），其余零位移。改后复跑同一扫描： No issues found，退出码 0，且 osv-scanner.toml 一字未动（仍是零豁免）。 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01BDmDsu2575gDxeMCxXhDE3 --- pnpm-lock.yaml | 9 +++++---- pnpm-workspace.yaml | 25 +++++++++++++++++++++++++ 2 files changed, 30 insertions(+), 4 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3637989226..091ce13199 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -34,6 +34,7 @@ overrides: fast-uri@<4.0.0: ^3.1.5 hono@<5.0.0: ^4.12.34 dompurify@<4.0.0: ^3.4.13 + nanoid@<4.0.0: ^3.3.17 importers: @@ -7403,8 +7404,8 @@ packages: resolution: {integrity: sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==} engines: {node: '>=8.0.0'} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -14106,7 +14107,7 @@ snapshots: dependencies: lru.min: 1.1.4 - nanoid@3.3.16: {} + nanoid@3.3.18: {} nanoid@6.0.0: {} @@ -14405,7 +14406,7 @@ snapshots: postcss@8.5.25: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index b0edbec496..d56d7c9832 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -210,3 +210,28 @@ overrides: # `<3.4.13`, which would self-invalidate the day 3.4.13 is itself flagged # (the undici 7.28.0 / brace-expansion 5.0.8 specimens, #4961 / #5032). 'dompurify@<4.0.0': '^3.4.13' + # OSV 2026-08-08 (#6529) — same "it names a fixed version, so take the fix" + # disposition as the two batches above; no exemption is involved. + # nanoid GHSA-2v37-7h3g-55p8 / CVE-2026-67213 (8.2 high) — a custom + # alphabet generator loops forever when `size` is zero, so an + # attacker-influenced size is a denial of service. The advisory carries + # TWO affected ranges: introduced:0 → fixed:3.3.17, and + # introduced:4.0.0 → fixed:5.1.6. Only the first one is live here. + # Transitive-only via postcss@8.5.25, which declares nanoid ^3.3.16 and + # was the single consumer pulling the flagged 3.3.16 (measured: one + # `nanoid:` edge in the whole lockfile). Nothing in this workspace + # declares a 3.x nanoid directly, so — exactly as for dompurify above — + # check-override-consistency.mjs lists this as an override it cannot + # cross-check against a declared range, which is correct for this shape. + # ^3.3.17 sits INSIDE postcss's own ^3.3.16 range, so this is a dedupe + # onto the patched line, not a forced upgrade past what postcss supports. + # ⚠️ The four drivers that declare nanoid ^6.0.0 (driver-mongodb, + # driver-sql, driver-sqlite-wasm, driver-turso) are deliberately OUT of + # this selector: 6.0.0 is above the advisory's second fixed line (5.1.6) + # and is not affected, and the <4.0.0 bound is what keeps it that way — + # a bound written at the package ceiling would have dragged that whole + # major back onto the 3.x line. + # Bound at the 4.0.0 major boundary per this block's header rule — never + # `<3.3.17`, which would self-invalidate the day 3.3.17 is itself flagged + # (the undici 7.28.0 / brace-expansion 5.0.8 specimens, #4961 / #5032). + 'nanoid@<4.0.0': '^3.3.17'