From f9f1c60993a0032b9439e38279e707cc65189746 Mon Sep 17 00:00:00 2001 From: Vibe Code Date: Fri, 7 Aug 2026 23:44:17 +0200 Subject: [PATCH] fchub-portal-extender: close the nanoid advisory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GHSA-2v37-7h3g-55p8, high. nanoid arrived at 3.3.16 underneath postcss, which this package pins to an exact 8.5.23 in overrides — so the fix was not reachable by bumping anything directly depended on. Moving the override to 8.5.26 pulls nanoid to 3.3.18. npm audit goes 1 high to 0. Bundle rebuilt, hashes churn. The enqueue resolves entries through assets/dist/.vite/manifest.json at runtime, and the manifest still has both the entry and the style.css fallback AdminMenu.php reads. --- plugins/fchub-portal-extender/package-lock.json | 14 +++++++------- plugins/fchub-portal-extender/package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/plugins/fchub-portal-extender/package-lock.json b/plugins/fchub-portal-extender/package-lock.json index 3604c07f..da4ad6ee 100644 --- a/plugins/fchub-portal-extender/package-lock.json +++ b/plugins/fchub-portal-extender/package-lock.json @@ -1760,9 +1760,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github", @@ -1831,9 +1831,9 @@ } }, "node_modules/postcss": { - "version": "8.5.23", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", - "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", + "version": "8.5.26", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", + "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==", "funding": [ { "type": "opencollective", @@ -1850,7 +1850,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.16", + "nanoid": "^3.3.17", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, diff --git a/plugins/fchub-portal-extender/package.json b/plugins/fchub-portal-extender/package.json index fcb303ae..7bf35664 100644 --- a/plugins/fchub-portal-extender/package.json +++ b/plugins/fchub-portal-extender/package.json @@ -22,6 +22,6 @@ "overrides": { "lodash": "4.18.1", "lodash-es": "4.18.1", - "postcss": "8.5.23" + "postcss": "8.5.26" } }