Conversation
Pin patched floors via pnpm.overrides and refresh the lockfile (both are transitive dependencies): - CVE-2026-67214: nanoid >= 3.3.16 <4 (kept on the 3.x/CJS line) - CVE-2026-69152: brace-expansion >= 1.1.18 / 2.1.4 / 5.0.9 CVE-2025-71329 (image-size) has no upstream patch (latest is 2.0.2); tracked separately until a fixed release ships. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
shabaraba
force-pushed
the
fix/fix-dep-dos-cves
branch
from
August 12, 2026 00:45
521c800 to
663882f
Compare
shabaraba
marked this pull request as ready for review
August 12, 2026 05:58
shabaraba
requested review from
chihiro-adachi and
nameless-mc
and removed request for
a team
August 12, 2026 05:58
Contributor
There was a problem hiding this comment.
Pull request overview
Updates dependency override floors to address reported DoS advisories in transitive dependencies (nanoid, brace-expansion) and refreshes the pnpm lockfile so the resolved graph no longer includes the flagged versions.
Changes:
- Adds a
pnpm.overridesentry fornanoid@^3and raisesbrace-expansionoverride floors for^1and^2. - Refreshes
pnpm-lock.yamlto reflect updated overrides/resolutions (including resolvednanoid@3.3.18,brace-expansion@1.1.18,brace-expansion@2.1.4).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| package.json | Updates pnpm.overrides floors (adds nanoid override; bumps brace-expansion floors). |
| pnpm-lock.yaml | Lockfile refresh reflecting updated overrides and resolved patched versions. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
121
to
+125
| "undici": ">=7.18.2", | ||
| "ws": ">=8.21.3", | ||
| "brace-expansion@^1": ">=1.1.16 <2", | ||
| "brace-expansion@^2": ">=2.1.2 <3", | ||
| "nanoid@^3": ">=3.3.16 <4", | ||
| "brace-expansion@^1": ">=1.1.18 <2", | ||
| "brace-expansion@^2": ">=2.1.4 <3", |
Comment on lines
9
to
+13
| undici: '>=7.18.2' | ||
| ws: '>=8.21.3' | ||
| brace-expansion@^1: '>=1.1.16 <2' | ||
| brace-expansion@^2: '>=2.1.2 <3' | ||
| nanoid@^3: '>=3.3.16 <4' | ||
| brace-expansion@^1: '>=1.1.18 <2' | ||
| brace-expansion@^2: '>=2.1.4 <3' |
Comment on lines
118
to
+124
| "pnpm": { | ||
| "overrides": { | ||
| "braces": ">=3.0.3", | ||
| "undici": ">=7.18.2", | ||
| "ws": ">=8.21.3", | ||
| "brace-expansion@^1": ">=1.1.16 <2", | ||
| "brace-expansion@^2": ">=2.1.2 <3", | ||
| "nanoid@^3": ">=3.3.16 <4", | ||
| "brace-expansion@^1": ">=1.1.18 <2", |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
These transitive dependencies had known DoS advisories. Bumping them to patched
versions removes the vulnerable code paths and clears dependency scanner alerts.
nanoid/non-secure): infinite loop on a negativesizeargument.intermediate arrays.
What
Raise the
pnpm.overridesfloors to patched versions and refresh the lockfile(lockfile-only; no source changes). Both packages are transitive, so the
override pins the security floor across the dependency graph:
nanoid@^3:>=3.3.16 <4(kept on the 3.x / CJS line) → 3.3.18brace-expansion@^1:>=1.1.18 <2→ 1.1.18brace-expansion@^2:>=2.1.4 <3→ 2.1.4brace-expansion@^5:>=5.0.9→ 5.0.9 (already satisfied)How to test
Lockfile-only change. Verified no vulnerable
nanoid/brace-expansionversionremains in
pnpm-lock.yaml. Relying on CIpnpm lint/pnpm testto confirmthe graph still resolves and builds (not run locally).
Checklist
pnpm lintandpnpm teston the root directory.