Skip to content

fix(deps): bump nanoid to 3.3.18 (CVE-2026-67213) - #96

Merged
humandebri merged 1 commit into
mainfrom
fix/dependabot-nanoid-override
Aug 18, 2026
Merged

fix(deps): bump nanoid to 3.3.18 (CVE-2026-67213)#96
humandebri merged 1 commit into
mainfrom
fix/dependabot-nanoid-override

Conversation

@humandebri

Copy link
Copy Markdown
Collaborator

dependabot アラート #76 対応。

  • CVE-2026-67213 (GHSA-2v37-7h3g-55p8): nanoid < 3.3.18 で custom generator が size 0 のとき無限ループする可能性(high)
  • pnpm-workspace.yaml の override を 3.3.17 → 3.3.18 に更新し、lockfile を再生成
  • 差分は nanoid 関連のみ(+6/-6)

@humandebri
humandebri merged commit 97f88b7 into main Aug 18, 2026
12 checks passed
@humandebri
humandebri deleted the fix/dependabot-nanoid-override branch August 18, 2026 07:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant