From 014e20ea915a3398a6bfd19f84b9fd345d20165c Mon Sep 17 00:00:00 2001
From: "scale-prodsec[bot]"
 <262621375+scale-prodsec[bot]@users.noreply.github.com>
Date: Sat, 8 Aug 2026 04:59:37 +0000
Subject: [PATCH] fix(agentex-ui): bump nanoid 3.3.16 -> 3.3.18
 (CVE-2026-67213)

nanoid 3.3.16 hangs in an infinite loop when customAlphabet/customRandom
are called with size 0 (CVE-2026-67213, HIGH). Pin the transitive
dependency (via postcss -> nanoid) to the patched 3.3.x line using the
existing overrides block.

Stays on the 3.x line: postcss consumes nanoid via
require("nanoid/non-secure"), and nanoid 5.x is ESM-only, so 5.1.6 would
break the consumer.

Verified: npm ci, typecheck, lint, 75 tests, next build, and a direct
size-0 repro all pass.
---
 agentex-ui/package-lock.json | 6 +++---
 agentex-ui/package.json      | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/agentex-ui/package-lock.json b/agentex-ui/package-lock.json
index 1d47f082..8052c1fb 100644
--- a/agentex-ui/package-lock.json
+++ b/agentex-ui/package-lock.json
@@ -9176,9 +9176,9 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "funding": [
         {
           "type": "github",
diff --git a/agentex-ui/package.json b/agentex-ui/package.json
index ef924466..9b5075ed 100644
--- a/agentex-ui/package.json
+++ b/agentex-ui/package.json
@@ -56,6 +56,7 @@
   },
   "overrides": {
     "cross-spawn": "^7.0.5",
+    "nanoid": "^3.3.17",
     "postcss": "^8.5.23",
     "sharp": "^0.35.0",
     "tar": "^7.5.21"