[PR #140] [MERGED] chore(frontend): bump nanoid to 3.3.18 (GHSA-2v37-7h3g-55p8) #140

New issue

Closed

opened 2026-08-22 07:31:55 +02:00 by zaph0d · 0 comments

zaph0d commented

2026-08-22 07:31:55 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/niels-emmer/myace/pull/140
Author: @niels-emmer
Created: 8/21/2026
Status: ✅ Merged
Merged: 8/21/2026
Merged by: @niels-emmer

Base: main ← Head: chore/bump-nanoid-3.3.18

📝 Commits (1)

3dc31f0 chore(frontend): bump nanoid to 3.3.18 to clear GHSA-2v37-7h3g-55p8

📊 Changes

1 file changed (+3 additions, -3 deletions)

View changed files

📝 frontend/package-lock.json (+3 -3)

📄 Description

Bumps transitive nanoid (via postcss, used by the vite/tailwind build toolchain) from 3.3.17 to 3.3.18 to clear the high-severity advisory GHSA-2v37-7h3g-55p8 (custom generators can loop indefinitely when size is zero).

npm audit now reports 0 vulnerabilities.
3.3.18 satisfies postcss's ^3.3.17 range — no other changes.
Production build verified.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/niels-emmer/myace/pull/140 **Author:** [@niels-emmer](https://github.com/niels-emmer) **Created:** 8/21/2026 **Status:** ✅ Merged **Merged:** 8/21/2026 **Merged by:** [@niels-emmer](https://github.com/niels-emmer) **Base:** `main` ← **Head:** `chore/bump-nanoid-3.3.18` --- ### 📝 Commits (1) - [`3dc31f0`](https://github.com/niels-emmer/myace/commit/3dc31f0d1ab06262b44a6fb08f54566b9d6335cc) chore(frontend): bump nanoid to 3.3.18 to clear GHSA-2v37-7h3g-55p8 ### 📊 Changes **1 file changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `frontend/package-lock.json` (+3 -3) </details> ### 📄 Description Bumps transitive `nanoid` (via postcss, used by the vite/tailwind build toolchain) from 3.3.17 to 3.3.18 to clear the high-severity advisory GHSA-2v37-7h3g-55p8 (custom generators can loop indefinitely when size is zero). - `npm audit` now reports 0 vulnerabilities. - 3.3.18 satisfies postcss's `^3.3.17` range — no other changes. - Production build verified. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

zaph0d

2026-08-22 07:31:55 +02:00