🔒 security(deps): pin nanoid to 3.3.18 across all workspaces by scttbnsn · Pull Request #673 · CodesWhat/drydock

scttbnsn · 2026-08-08T15:43:34Z

Summary

A new advisory pair against transitive nanoid started failing the qlty security gate on every push:

CVE-2026-67213 / GHSA-2v37-7h3g-55p8 — nanoid@3.3.16 (root, app, apps/demo, apps/web, ui lockfiles)
CVE-2026-67214 / GHSA-28wg-ghj8-5hjv — nanoid@3.3.12 (e2e lockfile)

Pins nanoid@3.3.18 (satisfies both fixed ranges) via the existing overrides security-pin pattern in all six workspace package.json files, following the js-yaml precedent in e2e. Lockfiles regenerated with --package-lock-only --ignore-scripts.

Testing

qlty check --no-progress --all → zero nanoid findings
npm run build clean in app/ and ui/
Full lefthook pre-push gate passed (coverage, e2e, playwright, zizmor)
No code changes — transitive dependency pin only

Changelog

🔒 Security: Pinned transitive nanoid dependencies to 3.3.18 in all six workspace package.json files.
🔧 Changed: Regenerated corresponding lockfiles with --package-lock-only --ignore-scripts.
🔒 Security: Addressed vulnerable transitive versions 3.3.16 and 3.3.12 from postcss and artillery.
🔧 Changed: Added no application code changes.

Validation

qlty security check passed.
app/ and ui/ builds passed.
Lefthook pre-push gate passed.

Concerns

Verify that all lockfiles resolve nanoid to 3.3.18.
Verify that future dependency updates preserve the six workspace overrides.

…6-67213/67214) - nanoid 3.3.16 (root, app, apps/demo, apps/web, ui — transitive via postcss) was vulnerable to GHSA-2v37-7h3g-55p8 (CVE-2026-67213), fixed in 3.3.17 - nanoid 3.3.12 (e2e — transitive via artillery) was vulnerable to both GHSA-2v37-7h3g-55p8 and GHSA-28wg-ghj8-5hjv (CVE-2026-67214, fixed in 3.3.16) - Added `nanoid: 3.3.18` overrides to all six workspace package.json files, following the existing js-yaml security-pin pattern, and regenerated the corresponding lockfiles

vercel · 2026-08-08T15:43:40Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview	Aug 8, 2026 3:45pm
drydockdemo-website	Ready	Preview	Aug 8, 2026 3:45pm

coderabbitai · 2026-08-08T15:43:59Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d2873f6c-3940-4b6f-81c8-9ee7fc381a93

📥 Commits

Reviewing files that changed from the base of the PR and between 322c7fd and 0e30a2a.

⛔ Files ignored due to path filters (7)

CHANGELOG.md is excluded by !CHANGELOG.md
app/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
apps/demo/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
apps/web/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
e2e/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
ui/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (6)

app/package.json
apps/demo/package.json
apps/web/package.json
e2e/package.json
package.json
ui/package.json

📝 Walkthrough

Walkthrough

Added a nanoid version override pinned to 3.3.18 in the root, app, demo, web, e2e, and ui package manifests. Existing undici, esbuild, @types/react-dom, and postcss overrides remain unchanged.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/v1.6-nanoid-cve

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

biggest-littlest

Dependency pin only, follows the existing overrides security-pin pattern, gate and CI green.

17-file identity roll-forward from rc.12 to rc.13, dated 2026-08-08. - CHANGELOG: new `[1.6.0-rc.13]` section from Unreleased content — #670 digest re-anchoring, #672 self-hosted Star History, #673 nanoid pin, #682 node 24.19.0 + trivy 0.73.0 base-image bumps, #683 icon-bundle alias resolution — plus compare-link rotation - README: version badge + rc.13 highlights block - Demo mocks, site config/content, docs API pages, quickstart, updates highlights, identity-test constants, changelog-link pairs Guarded by `scripts/release-identity.test.mjs` (4/4) and the web scripts suite (56/56). Once merged: dev→main wholesale-tree sync, then dispatch `release-cut.yml` for `v1.6.0-rc.13`. GA candidate clock restarts — earliest GA ≈ Aug 16.  ## Changelog 🔧 **Changed** - Advanced the release identity from `1.6.0-rc.12` to `1.6.0-rc.13`, dated August 8, 2026. - Updated README, demo mocks, site configuration, roadmap content, API examples, quickstart, and update highlights. - Updated changelog comparison links and release identity test constants. - Added release notes for digest re-anchoring, self-hosted Star History, `nanoid` pins, Node 24.19.0 and Trivy 0.73.0 base images, and icon-bundle alias resolution. 🔒 **Security** - Documented workspace-wide `nanoid` security pinning. - Documented base-image CVE remediation. ## Concerns - Sync the `dev` tree to `main` after merge. - Dispatch `release-cut.yml` for `v1.6.0-rc.13`. - Confirm the expected GA date remains approximately August 16.

Wholesale-tree sync ahead of the v1.6.0-rc.13 cut (same pattern as #667). The single commit carries the exact tree of `dev/v1.6` at b98808e onto `main` — after merge, `git diff --quiet origin/main origin/dev/v1.6` holds. Content on dev since rc.12: - #669/#670 — release-cut digest re-anchoring - #672 — self-hosted Star History chart - #673 — NAS acceptance follow-ups - #681 — v1.7 dependency ordering (forward-ported) - #682 — CVE base-image bumps + digest-pinned Node base guard test - #683 — icon-bundle alias resolution (fixes blank Audit/registry icons shipped in rc.12) - #684 — rc.13 identity roll-forward (17 files, CHANGELOG, README)  ## Changelog - ✨ Added repository-aware Docker digest selection and multi-anchor comparison. - ✨ Added self-hosted, theme-aware Star History SVG API with pagination, caching, deadlines, and fallback rendering. - ✨ Added icon alias resolution and bundle coverage tests. - ✨ Added required icon bundle entries and updated icon mappings. - 🔧 Updated Node and Trivy image digests. - 🔒 Pinned `nanoid` to `3.3.18` across workspaces. - 🔒 Added a digest-pinned Node 24 Alpine base-image guard test. - 🔧 Updated `js-yaml` override to `3.15.1`. - 🔧 Updated release documentation, examples, mocks, badges, and tests to `1.6.0-rc.13`. - 🔧 Removed the external Star History CSP allowlist and embed. ## Concerns - Verify the Star History route stays within GitHub API rate limits under concurrent requests. - Verify cache headers do not serve incomplete or repository-specific fallback responses incorrectly. - Verify Docker digest re-anchoring preserves legacy behavior for stored containers without `repoDigests`. - Verify icon aliases with rotation or flipping have acceptable fallback behavior. - Run the Docker, Star History, icon-bundle, release-identity, and workspace dependency tests.

scttbnsn requested review from ALARGECOMPANY and biggest-littlest as code owners August 8, 2026 15:43

vercel Bot deployed to Preview – drydock-website August 8, 2026 15:45 View deployment

vercel Bot deployed to Preview – drydockdemo-website August 8, 2026 15:45 View deployment

biggest-littlest approved these changes Aug 8, 2026

View reviewed changes

scttbnsn merged commit 9e4e56c into dev/v1.6 Aug 8, 2026
25 checks passed

scttbnsn deleted the fix/v1.6-nanoid-cve branch August 8, 2026 16:14

scttbnsn mentioned this pull request Aug 9, 2026

🔧 chore(release): roll release identity forward to v1.6.0-rc.13 #684

Merged

scttbnsn mentioned this pull request Aug 9, 2026

🚀 release: sync dev/v1.6 → main for v1.6.0-rc.13 #685

Merged

Navigation Menu

Uh oh!

Uh oh!

🔒 security(deps): pin nanoid to 3.3.18 across all workspaces - #673

🔒 security(deps): pin nanoid to 3.3.18 across all workspaces#673
scttbnsn merged 1 commit into
dev/v1.6from
fix/v1.6-nanoid-cve

scttbnsn commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading

Walkthrough

Uh oh!

biggest-littlest left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

scttbnsn commented Aug 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Changelog

Validation

Concerns

Uh oh!

vercel Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

biggest-littlest left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

scttbnsn commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Aug 8, 2026 •

edited

Loading

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading