From 246a03e3ce7743efe2996887e7c9d29518ef9d40 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 16:35:32 +0000 Subject: [PATCH] fix: bump nanoid to 3.3.18 to resolve GHSA-2v37-7h3g-55p8 nanoid before 3.3.18 (3.x line) can infinite-loop in customAlphabet/ customRandom when size is 0. It is a transitive dependency of postcss (nanoid: ^3.3.12), which already admits 3.3.18, so this is a lockfile-only refresh with no package.json changes required. Refs DEVX-8508. Co-Authored-By: Warp --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4962783..f892d66 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5422,9 +5422,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github",