From ab06df6ab1fcc8e5af369d29495163abb37950a2 Mon Sep 17 00:00:00 2001
From: dariia <drobotcko@gmail.com>
Date: Mon, 10 Aug 2026 18:27:00 +0200
Subject: [PATCH] fix(deps): override nanoid to 3.3.17 to fix infinite loop DoS

Transitive dependency via @vue/cli-service and vitest was pinned to
nanoid 3.3.16, which is vulnerable when custom generators use size 0.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 package-lock.json | 36 ++++++++++++++++++------------------
 package.json      |  3 ++-
 2 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d135eee..399258f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7886,24 +7886,6 @@
         "thenify-all": "^1.0.0"
       }
     },
-    "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
     "node_modules/negotiator": {
       "version": "0.6.4",
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
@@ -9123,6 +9105,24 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/postcss/node_modules/nanoid": {
+      "version": "3.3.17",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
     "node_modules/prettier": {
       "version": "2.8.8",
       "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.8.8.tgz",
diff --git a/package.json b/package.json
index 13eb3a1..a3c936a 100644
--- a/package.json
+++ b/package.json
@@ -46,6 +46,7 @@
     "serialize-javascript": "7.0.5",
     "svgo": ">=2.8.1",
     "qs": ">=6.15.2",
-    "uuid": "11.1.1"
+    "uuid": "11.1.1",
+    "nanoid": "3.3.17"
   }
 }