From 7f378414ed7502956196bdeca05b43f8a38b10b8 Mon Sep 17 00:00:00 2001 From: webreflection Date: Wed, 26 Aug 2026 16:18:51 +0200 Subject: [PATCH 1/2] fix(security): nanoid updated due dependabot warnings --- .changeset/nanoid-security-update.md | 5 +++++ bun.lock | 3 ++- package.json | 1 + packages/kilo-docs/pnpm-lock.yaml | 10 +++++----- 4 files changed, 13 insertions(+), 6 deletions(-) create mode 100644 .changeset/nanoid-security-update.md diff --git a/.changeset/nanoid-security-update.md b/.changeset/nanoid-security-update.md new file mode 100644 index 0000000000..85690333e8 --- /dev/null +++ b/.changeset/nanoid-security-update.md @@ -0,0 +1,5 @@ +--- +"@kilocode/kilo-docs": patch +--- + +Update nanoid to 3.3.18 to fix the infinite loop vulnerability flagged by Dependabot. diff --git a/bun.lock b/bun.lock index 7f314aa99b..2b48278b2e 100644 --- a/bun.lock +++ b/bun.lock @@ -1035,6 +1035,7 @@ "fastify": ">=5.8.3", "happy-dom": ">=20.8.9", "lodash": "4.18.1", + "nanoid": ">=3.3.18", "path-to-regexp": ">=8.4.0", "picomatch": ">=2.3.2", "smol-toml": ">=1.6.1", @@ -3998,7 +3999,7 @@ "nanoevents": ["nanoevents@7.0.1", "", {}, "sha512-o6lpKiCxLeijK4hgsqfR6CNToPyRU3keKyyI6uwuHRvpRTbZ0wXw51WRgyldVugZqoJfkGFrjrIenYH3bfEO3Q=="], - "nanoid": ["nanoid@3.3.17", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g=="], + "nanoid": ["nanoid@3.3.18", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w=="], "napi-build-utils": ["napi-build-utils@2.0.0", "", {}, "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA=="], diff --git a/package.json b/package.json index a6c3fe6dca..dbe9f085e6 100644 --- a/package.json +++ b/package.json @@ -153,6 +153,7 @@ "vite": "7.3.5", "diff": "8.0.4", "dompurify": "3.4.2", + "nanoid": ">=3.3.18", "happy-dom": ">=20.8.9", "@opentui/core": "catalog:", "@opentui/solid": "catalog:", diff --git a/packages/kilo-docs/pnpm-lock.yaml b/packages/kilo-docs/pnpm-lock.yaml index 6ca1dd11e8..772c21aa03 100644 --- a/packages/kilo-docs/pnpm-lock.yaml +++ b/packages/kilo-docs/pnpm-lock.yaml @@ -1212,8 +1212,8 @@ packages: mermaid@11.15.0: resolution: {integrity: sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==} - nanoid@3.3.17: - resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -2518,7 +2518,7 @@ snapshots: ts-dedent: 2.3.0 uuid: 14.0.1 - nanoid@3.3.17: {} + nanoid@3.3.18: {} next@16.3.0(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): dependencies: @@ -2570,13 +2570,13 @@ snapshots: postcss@8.5.23: dependencies: - nanoid: 3.3.17 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 postcss@8.5.26: dependencies: - nanoid: 3.3.17 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 From 08608e1289c6e7a513c7455a1e56000f3860c6fb Mon Sep 17 00:00:00 2001 From: webreflection Date: Wed, 26 Aug 2026 16:29:28 +0200 Subject: [PATCH 2/2] fix(security): drop nanoid override from package.json --- bun.lock | 1 - package.json | 1 - 2 files changed, 2 deletions(-) diff --git a/bun.lock b/bun.lock index 2b48278b2e..9d04abd4f6 100644 --- a/bun.lock +++ b/bun.lock @@ -1035,7 +1035,6 @@ "fastify": ">=5.8.3", "happy-dom": ">=20.8.9", "lodash": "4.18.1", - "nanoid": ">=3.3.18", "path-to-regexp": ">=8.4.0", "picomatch": ">=2.3.2", "smol-toml": ">=1.6.1", diff --git a/package.json b/package.json index dbe9f085e6..a6c3fe6dca 100644 --- a/package.json +++ b/package.json @@ -153,7 +153,6 @@ "vite": "7.3.5", "diff": "8.0.4", "dompurify": "3.4.2", - "nanoid": ">=3.3.18", "happy-dom": ">=20.8.9", "@opentui/core": "catalog:", "@opentui/solid": "catalog:",