Repository navigation
Backport #4335: [core] Fix vulnerable nanoid pin by dropping the dependency - #4881
Closed
github-actions[bot] wants to merge 1 commit into
Closed
github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
Closes #3842. `@workflow/core` pins `nanoid` exactly at `5.1.6`, which is in the vulnerable range of [GHSA-28wg-ghj8-5hjv](GHSA-28wg-ghj8-5hjv) (high, `>=4.0.0 <5.1.16`). Because the pin is exact, apps can only move off it with an `overrides`/`resolutions` entry. This PR removes the dependency instead of bumping it. Core uses nanoid only to build the seeded generator for default hook tokens: `customRandom(urlAlphabet, 21, bytes from the run-seeded PRNG)`. In 5.1.16, `customRandom` requests 21 bytes per id instead of 34. For the same seed, that changes both the hook token and every seeded value drawn after it (`Math.random()` inside the workflow, later tokens): | seed `wrun_test:seed` | 1st token | 2nd token | next `Math.random()` | |---|---|---|---| | nanoid 5.1.6 | `pVjvQyygUGbIid9mUBIhp` | `mgNKWnMBr9yywfW_syBGT` | `0.3399…` | | nanoid 5.1.16 | `d9mUBIhphoZLwZ1T1ma-k` | `jdT3d6rupVjvQyygUGbIi` | `0.1769…` | A run recorded before the upgrade and replayed after it would diverge. On `stable`, a plain bump failed the `hook-sleep-interaction` replay tests with `ReplayDivergenceError` (see #4336's history). The same applies to users who add a `nanoid` override today. - `packages/core/src/seeded-nanoid.ts` reproduces nanoid 5.1.6's `customRandom(urlAlphabet, 21, ...)` exactly: 34 draws per id, read from the end of the batch. - `seeded-nanoid.test.ts` pins the recorded 5.1.6 output and PRNG position, so any change to the draw pattern fails a test. - The node:vm engine (`workflow.ts`), the QuickJS engine (`runtime/quickjs-runtime.ts`) and the test helpers all use it. - `nanoid` is removed from `@workflow/core`'s dependencies. - The two private Next.js workbenches, which use nanoid directly, are bumped to 5.1.16. - Changeset: patch for `@workflow/core`, worded as a security fix so the backport check picks it up. - `pnpm --filter @workflow/core test` passes (3070 tests on current `main`), and `typecheck` passes. - Installing this PR's workflow-tarballs build and running `npm audit --omit=dev` reports 0 vulnerabilities, with no `nanoid` in the tree. - #4336 carries the same change for `stable` (4.x), plus the undici 7.29.0 backport from #3315. - #3545 is the community PR for the plain bump. It has the replay issue described above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Pranay Prakash <1797812+pranaygp@users.noreply.github.com> Co-authored-by: Peter Wielander <peter.wielander@vercel.com> Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
|
Contributor
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated backport of #4335 to
stable(backport job run).AI recommendation: This is a security fix: it removes the exact
nanoid@5.1.6pin affected by GHSA-28wg-ghj8-5hjv, whichstablestill carries (packages/core/package.jsononorigin/stablepinsnanoid: 5.1.6), while preserving the existing seeded-token/PRNG draw pattern so recorded runs do not diverge on replay. The rest of the diff is mechanical call-site updates plus a test pinning the 5.1.6 golden output; note the QuickJS engine file does not exist onstable, so that hunk will need dropping, and PR #4336 may already carry an equivalent change for 4.x.Merge conflicts were resolved by AI (opencode with
anthropic/claude-opus-5). Please review the conflict resolution carefully before merging.