From b035fbe55d9f423557dc4c0530ce6577151f4004 Mon Sep 17 00:00:00 2001 From: Manoj Kumar Date: Mon, 10 Aug 2026 15:33:35 +0530 Subject: [PATCH] fix(root): bump nanoid to 3.3.17 via yarn resolution Add yarn resolution to pin nanoid to 3.3.17, fixing GHSA-2v37-7h3g-55p8 (CVE-2026-67213, CVSS 8.2), a DoS via infinite loop in customAlphabet and customRandom when called with size 0. Version 3.3.17 is the fixed release; the previously resolved 3.3.16 was one patch behind. This was blocking the @bitgo-beta release workflow's OSV vulnerability severity gate (CVSS >= 7.0 threshold). Ticket: CECHO-1893 Co-Authored-By: Claude Haiku 4.5 --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 286bf41339..f60d7dce1f 100644 --- a/package.json +++ b/package.json @@ -153,7 +153,8 @@ "uuid": "11.1.1", "js-yaml": "4.3.1", "ip-address": "10.4.0", - "socket.io-parser": "4.2.7" + "socket.io-parser": "4.2.7", + "nanoid": "3.3.17" }, "overrides": { "qs": "6.15.2", diff --git a/yarn.lock b/yarn.lock index 1ac87274fa..123c5d4137 100644 --- a/yarn.lock +++ b/yarn.lock @@ -15553,10 +15553,10 @@ nanoevents@^9.1.0: resolved "https://registry.npmjs.org/nanoevents/-/nanoevents-9.1.0.tgz" integrity sha512-Jd0fILWG44a9luj8v5kED4WI+zfkkgwKyRQKItTtlPfEsh7Lznfi1kr8/iZ+XAIss4Qq5GqRB0qtWbaz9ceO/A== -nanoid@^3.3.12: - version "3.3.16" - resolved "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz#a04d8ec4b1f10009d2d533947aefe4293737816c" - integrity sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q== +nanoid@3.3.17, nanoid@^3.3.12: + version "3.3.17" + resolved "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz#f1c3aa253c52547956a52c50bff754316f61037a" + integrity sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g== natural-compare@^1.4.0: version "1.4.0"