From efcea003937e79d78a146faee8eec339718be97b Mon Sep 17 00:00:00 2001 From: biosxxx Date: Mon, 17 Aug 2026 08:22:22 +0300 Subject: [PATCH] Pin nanoid to a patched 3.x MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New high advisory: nanoid's custom generators loop indefinitely when size is zero. The installed 3.3.16 comes in only through postcss, which is not a place this project passes a user-controlled size to — but postcss runs on every build and the fix is a version floor, so there is no reason to carry it. Pinned with a caret rather than the >= used by some of the neighbouring entries. ">=3.3.18" resolves to nanoid 6.0.1, three majors up and ESM-only, which postcss cannot require — it asks for ^3.3.16. "^3.3.18" keeps the bump inside 3.x. pnpm why now reports a single nanoid@3.3.18 under postcss. typecheck and a six-locale build pass, which exercises postcss throughout. Co-Authored-By: Claude Opus 5 --- package.json | 3 ++- pnpm-lock.yaml | 11 ++++++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 1b67166..ee0a979 100644 --- a/package.json +++ b/package.json @@ -144,7 +144,8 @@ "undici@<6.28.0": "^6.28.0", "minimatch@>=10.0.0 <10.2.3": ">=10.2.3", "smol-toml@<1.6.1": ">=1.6.1", - "tar@<=7.5.20": ">=7.5.21" + "tar@<=7.5.20": ">=7.5.21", + "nanoid@<3.3.18": "^3.3.18" }, "patchedDependencies": { "gray-matter@4.0.3": "patches/gray-matter@4.0.3.patch" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 66d50a6..ca6dec4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -38,6 +38,7 @@ overrides: minimatch@>=10.0.0 <10.2.3: '>=10.2.3' smol-toml@<1.6.1: '>=1.6.1' tar@<=7.5.20: '>=7.5.21' + nanoid@<3.3.18: ^3.3.18 patchedDependencies: gray-matter@4.0.3: @@ -5852,8 +5853,8 @@ packages: postprocessing: '>=6.30.0' three: '>=0.137' - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -12765,7 +12766,7 @@ snapshots: canvg@3.0.11: dependencies: - '@babel/runtime': 7.29.2 + '@babel/runtime': 7.29.7 '@types/raf': 3.4.3 core-js: 3.46.0 raf: 3.4.1 @@ -15243,7 +15244,7 @@ snapshots: postprocessing: 6.38.2(three@0.182.0) three: 0.182.0 - nanoid@3.3.16: {} + nanoid@3.3.18: {} natural-compare@1.4.0: {} @@ -16015,7 +16016,7 @@ snapshots: postcss@8.5.24: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1