fix(deps): bump nanoid to 3.3.18 (high GHSA-2v37-7h3g-55p8) - #770
Merged
Conversation
![caffeine-ci-generic-rw[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Contributor
Cursor AI review👍 APPROVE — looks safe to merge
VerdictDecision: APPROVE Generated for commit 2b499de |
automation-sa-sre
approved these changes
Aug 17, 2026
automation-sa-sre
left a comment
automation-sa-sre
left a comment
There was a problem hiding this comment.
Automated approval: the AI review verdict for 2b499de is APPROVE. See the "Cursor AI review" comment for details.
Kamirus
added a commit
that referenced
this pull request
Aug 20, 2026
Folds the 3.x line into `main` ahead of the 3.0.0 GA. 68 commits, 291 files. `main` becomes the 3.x development and release line; `v3` is deleted on merge. `v2` stays as an archive of the 2.x line with no release path. ## Squash this `main` is governed by ruleset `main` (id 20838766) with `required_linear_history` and no bypass actors, so a merge commit is rejected — `allowed_merge_methods: ["squash", "merge"]` is contradictory config that fails at merge time. Every one of main's last 40 commits has a single parent, so linear history here is deliberate and consistently applied, not incidental. **Squash and merge** is therefore the method. Before merging, tag the branch so the 68 commits survive its deletion: ```bash git tag v3-final origin/v3 && git push origin v3-final ``` Safe to push: `release.yml` triggers only on `cli-v*`, so `v3-final` fires nothing. Without it the commits become unreachable from any branch once `v3` is auto-deleted — recoverable only through `refs/pull/*/head`. Two alternatives, both rejected: - **Rebase-linearize onto `main`.** Would keep all 68 commits *and* satisfy linear history, but replaying them individually conflicts (first failure at `319951b3 chore(cli)!: require Node >= 20…`) even though the merge itself is clean. Resolving conflicts across 62 replays to land a promotion is not worth it. - **Temporarily drop `required_linear_history`, merge, restore.** Works and puts all 68 commits in main's log, but fights a policy the repo applies uniformly. The tag gets the same preservation without touching the ruleset. ## Still blocking - **One approving review.** `required_approving_review_count: 1` with no bypass actors, and the PR author cannot self-approve. - **Status checks**: `ci-ok`, `ci-ok-cli`, `ci-ok-mops`. ## No conflicts, and no sync needed Test-merged locally: clean, zero conflicts. The two `nanoid` GHSA bumps that were only on `main` ([#769](#769), [#770](#770)) merge without intervention — `nanoid 3.3.18` is present in both `blog/` and `docs/` lockfiles in the merged tree. An extra `main` → `v3` sync beforehand would have added a merge commit for nothing. I also checked that `v3` content wins everywhere it must: `lastVersion: 'current'` in the Docusaurus config, the `main`-only release guard, the consolidated `## Next` with no `## 3.0.0 (unreleased)` heading, no `cli/legacy-lock-flag.ts`, and the release post and 3.x `mops-verify` page both present. ## What lands Breaking changes, each with its migration in the changelog's **Migrating from 2.x** list: - `dfx` support removed outright — no `moc` fallback, no `--replica`, no `toolchain init` / `moc-wrapper`, no `watch --deploy` / `--generate`, `dfx` rejected in `[package]` - Every toolchain tool must be pinned: `moc`, and `pocket-ic` for replica tests / `bench` / `--check-deploy`, with no silent default. `[optimize]` requires a `wasm-opt` pin and no longer rewrites `mops.toml` from a build-time network lookup - One lockfile model: `--locked` replaces `--lock <check|update|ignore>`, plain installs self-heal, the `CI` env-var auto-detection is gone - Integrity verified at download time; `mops verify` is the on-disk audit - `.most` required for `check-stable` baselines - Node.js >= 20; `set-network` / `get-network` and vessel migration removed - Stricter defaults: unknown flags before `--` rejected, `watch` conservative, `test` verbose, `info --versions` newest-first Plus the install-engine work — parallel downloads, batched registry hash fetches, single-pass resolution, self-healing on transient network failures — and a long tail of resolution, `sync`/`add`/`remove` and cache fixes. ## After merging 1. Re-enable squash merging. 2. Rename `blog/blog/2026-08-19/` to the GA date — the post is dated by directory and the release tag is what publishes it. 3. Run **Prepare CLI release** → `major`. `cli/package.json` is at `2.24.0`, so this produces `3.0.0` and rolls the single `## Next` into one `## 3.0.0`. 4. Merging the release PR pushes `cli-v3.0.0`, which publishes npm, the GitHub Release, `cli.mops.one`, and the docs canister — the deploy that makes 3.x the site root and moves 2.x to `/2.x`. 5. Repoint or drop the npm `next` dist-tag, which otherwise keeps serving `3.0.0-beta.5`. 6. [#711](#711) currently shows the whole `v3` delta because its head branches off `v3`; that collapses back to its own three commits once this lands, with no rebase. CI here runs against the full 68-commit delta, so it is a real signal rather than a formality. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Michael Morandi <michael.morandi@caffeine.ai> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: caffeine-ci-bot[bot] <249119985+caffeine-ci-bot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated fix from the
security-autofixpipeline incaffeinelabs/infra.Dependabot alert #613 —
nanoid→3.3.18(high,GHSA-2v37-7h3g-55p8).A coding agent (Cursor) upgraded the vulnerable dependency to the fixed
version, regenerated the lockfile, and made the minimal code changes needed to
keep the build coherent. The diff is intended to be small and obviously
correct.
Review like any PR:
lockfile change is consistent.
won't reopen it while this
bot/depbot-autofix/613PR exists, and thealert stays in the daily/weekly digest until it's resolved.
🤖 Generated by the security-autofix workflow via Cursor.