fchub-portal-extender: close the nanoid advisory - #118
Conversation
GHSA-2v37-7h3g-55p8, high. nanoid arrived at 3.3.16 underneath postcss, which this package pins to an exact 8.5.23 in overrides — so the fix was not reachable by bumping anything directly depended on. Moving the override to 8.5.26 pulls nanoid to 3.3.18. npm audit goes 1 high to 0. Bundle rebuilt, hashes churn. The enqueue resolves entries through assets/dist/.vite/manifest.json at runtime, and the manifest still has both the entry and the style.css fallback AdminMenu.php reads.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Review Summary Minimal, correct security fix. The Issues: 0 blocking, 0 suggestions, 1 nit The committed |
1 participant
A new high-severity advisory landed after tonight's merges: GHSA-2v37-7h3g-55p8,
nanoidbelow 3.3.17.It was not reachable by bumping a direct dependency.
nanoidsits underneathpostcss, which this package pins to an exact8.5.23inoverrides— so the pin that was there to control one thing was holding back another. Moving the override to8.5.26resolvesnanoidto 3.3.18.npm audit: 1 high → 0.The bundle rebuilds, so the committed
assets/dist/hashes churn. Safe:AdminMenu.phpresolves entries throughassets/dist/.vite/manifest.jsonat runtime rather than hardcoding names, and the regenerated manifest still carries both theresources/admin/main.jsentry and thestyle.cssfallback it reads.The same advisory raised four alerts against
fchub-stream. Those are dismissed asnot_used— discontinued, not built, not released.