From a43b9b33e0dbeaaafb0946451eba904e0431d8ad Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Mon, 17 Aug 2026 08:41:25 +0000 Subject: [PATCH 1/2] chore: upgrade nanoid to ^3.3.18 to address CVE-2026-67214 Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/yarn.lock b/yarn.lock index 729066911..ade569701 100644 --- a/yarn.lock +++ b/yarn.lock @@ -18864,21 +18864,12 @@ __metadata: languageName: node linkType: hard -"nanoid@npm:^3.3.12": - version: 3.3.12 - resolution: "nanoid@npm:3.3.12" +"nanoid@npm:^3.3.12, nanoid@npm:^3.3.16": + version: 3.3.18 + resolution: "nanoid@npm:3.3.18" bin: nanoid: bin/nanoid.cjs - checksum: 10c0/ba142b7b39e11e80c16dd74b0365d407880c87c1cf7e1480956981ae940ee36060fa5b6f092cd1e315184dd19244c657bd017d03327bd3c62247d691c5e8edfb - languageName: node - linkType: hard - -"nanoid@npm:^3.3.16": - version: 3.3.16 - resolution: "nanoid@npm:3.3.16" - bin: - nanoid: bin/nanoid.cjs - checksum: 10c0/bbf2dcffe22d2b62d16de2711752070b539c0f644c7916f823ad6521986b2078cbe524f2d6240f58c46e9141ea0c7b87a029e100c0f7f175228cacaf30e41bba + checksum: 10c0/b994b4e396730f8be2520923284e2040d61eaee55cc6d4935ef6d38d34bafdc46133eda4d3faea5073bda545aa6079d82b886caeac5c731cf9ac18bcc1301425 languageName: node linkType: hard From d251a75b70ee4239effd48e03e8ae6e17e0f1201 Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Mon, 17 Aug 2026 08:41:46 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for nanoid upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cd9633879..7d9e5d936 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Upgraded Next.js to 16.3.1 to bound memory retained by high-cardinality dynamic route cache entries. [#1594](https://github.com/sourcebot-dev/sourcebot/pull/1594) - Fixed memory leak attributed to CodeMirror allocating objects on heap that were never freed. [#1580](https://github.com/sourcebot-dev/sourcebot/pull/1580) - Kept Git provider credentials out of subprocess arguments and on-disk configuration by using isolated in-memory credential caches. [#1584](https://github.com/sourcebot-dev/sourcebot/pull/1584) +- Upgraded `nanoid` to `^3.3.18`. [#1600](https://github.com/sourcebot-dev/sourcebot/pull/1600) ## [5.1.7] - 2026-08-13