From 51c3cb1bcf5948402bf9881073965a277623dc22 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 03:28:07 +0000 Subject: [PATCH 1/2] chore(deps-dev): bump js-yaml in /src/StackAlchemist.Web Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- src/StackAlchemist.Web/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/StackAlchemist.Web/package-lock.json b/src/StackAlchemist.Web/package-lock.json index 82c99ef..767262b 100644 --- a/src/StackAlchemist.Web/package-lock.json +++ b/src/StackAlchemist.Web/package-lock.json @@ -6810,9 +6810,9 @@ "dev": true }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { From 08303f8a39e75008f1a63db72277af8bdfbf89e0 Mon Sep 17 00:00:00 2001 From: Steve Fackley Date: Fri, 14 Aug 2026 22:10:38 -0400 Subject: [PATCH 2/2] fix(deps): re-resolve nanoid to 3.3.18 (GHSA-2v37-7h3g-55p8) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The js-yaml bump on this branch was red for an unrelated reason: the audit:ci gate fails on GHSA-2v37-7h3g-55p8 (high, nanoid) — custom generators can loop indefinitely when size is zero. nanoid is pulled in transitively by postcss, whose range is already ^3.3.16, so the patched 3.3.18 was permitted all along; npm simply never re-resolves a lockfile entry that still satisfies its range. `npm update nanoid` re-resolves it. Same failure shape as GHSA-rgw5-rvv9-x895 (#280): an unresolved advisory in the audit gate reds out every open PR, including this one. Verified locally in src/StackAlchemist.Web: npm ls nanoid --all -> postcss@8.5.24 -> nanoid@3.3.18 (single chain) npm run audit:ci -> 0 unresolved advisories at moderate or above npm run lint -> clean npx tsc --noEmit -> clean npx vitest run --coverage -> pass --- src/StackAlchemist.Web/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/StackAlchemist.Web/package-lock.json b/src/StackAlchemist.Web/package-lock.json index 767262b..ad1cdec 100644 --- a/src/StackAlchemist.Web/package-lock.json +++ b/src/StackAlchemist.Web/package-lock.json @@ -8380,9 +8380,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github",