fix: bump nanoid to 3.3.18 to patch CVE-2026-67213

[maxigimenez]

User description

nanoid 3.3.16 → 3.3.18, lockfile only. postcss requests ^3.3.16, which already admits 3.3.18, so no manifest change is needed.

Tier A — ready to merge on sight, subject to the CI confirmation in the evidence comment below.

This finding has no Vanta record. It has been reported without action by three consecutive triage runs, held each time by a PR budget that is now clear. See the evidence comment for the full write-up.

Verification

Command	Result
npm ci	clean, installs nanoid@3.3.18, integrity verified
npm run build	passes, 7 files emitted
npx vitest run	17 files, 435/435 pass
npm audit	2 vulnerabilities → 1; the nanoid high is gone

The one remaining advisory is @hono/node-server (moderate), which Dependabot #170 already covers. This PR deliberately leaves it alone so the two do not collide.

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Upgrade the locked nanoid dependency to 3.3.18 to address CVE-2026-67213 while retaining the existing manifest range through postcss. Preserve verified installation, build, test, and audit behavior with the remaining @hono/node-server advisory handled separately.

Latest Contributors(2)

User	Commit	Date
noreply@anthropic.com	fix: bump nanoid to 3....	August 31, 2026
gimenez.maxi@gmail.com	Merge pull request #16...	August 21, 2026

_{Review this PR on Baz | Customize your next review}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• mcp-server/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9febf7b3-32b1-4560-b85d-42dcc901e473

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[maxigimenez]

Triage verdict — Tier A, ready to merge, nothing outstanding

What and why

nanoid 3.3.16 → 3.3.18 (high; via vitest → vite → postcss)

• GHSA-2v37-7h3g-55p8 — CVE-2026-67213 — CVSS 8.2 (high)
• Also clears the older GHSA-28wg-ghj8-5hjv range as a side effect of landing on 3.3.18.

No Vanta record, so no SLA date. This package has never been ingested for this repository — the only currents-mcp finding Vanta carries is alert 144 (@hono/node-server, moderate, due 2026-10-11). Three consecutive triage runs reported this without action, each held by a PR budget that is now clear. It is in today's digest again under "in the lockfile, not in Vanta".

Exposure — development only

Advisory impact, quoted:

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread.

The installed copy is "dev": true and reached only through vitest → vite → postcss. npm ls nanoid against the production tree resolves empty, and the package is not among the five runtime dependencies (@modelcontextprotocol/sdk, commander, pino, pino-pretty, zod). So it is absent from the published @currents/mcp bundle — the risk is to the test toolchain, not to anything shipped.

The fix

Mechanism lockfile-upgrade. postcss requests ^3.3.16, which already admits 3.3.18, so no manifest edit and no overrides pin is needed — the narrowest mechanism available.

Diff is mcp-server/package-lock.json alone: one stanza, three lines changed (version, resolved, integrity). No metadata churn.

Breaking-change check

nanoid's changelog for the versions crossed:

• 3.3.17 — "Fixed infinite loop on zero size."
• 3.3.16 — "Fixed infinite loop on negative size."

Bug fixes only. No API changes, no removals, no breaking-change section in range.

Verification

Command	Result
npm ci	clean, installs nanoid@3.3.18, integrity verified
npm run build	passes — tsdown, 7 files, 157.53 kB total
npx vitest run	17 files, 435/435 pass
npm audit	2 vulnerabilities → 1; the nanoid high is gone

No new peer-dependency warnings: nanoid declares no peerDependencies and no dependencies, and it is the only stanza the diff touches, so none can be introduced.

CI coverage

The diff touches mcp-server/package-lock.json. Workflows this triggers, with conclusions for head 0301fb8:

Workflow / check	Triggered	Conclusion
Unit Tests — Test (Node 20.x)	yes	success
Unit Tests — Test (Node 22.x)	yes	success
Unit Tests — Test (Node 24.x)	yes	success
Dependabot PR Review	yes	skipped — gated to dependabot[bot], correct for this PR

Not triggered by this diff, by design: publish.yaml, release.yaml, promote.yaml, post-release.yaml, linear-release.yaml, auto-pr-parity-branch.yaml, parity-pr-merged.yaml — all release- or push-driven. test.yml has no paths filter, so a lockfile-only diff does run the full unit matrix here; there is no silent-skip gap.

Baz Reviewer was still in progress at the time of writing. It is a review bot, not a test gate.

What a human should still check

Nothing. Every workflow this diff triggers ran for the head SHA and concluded successfully, the upgrade is a two-patch bump inside a range that already admitted it, and the package does not ship.

Needs release

Nothing. nanoid is dev-only and absent from the bundle, so no @currents/mcp release is required for this fix to take effect.

---

Generated by Claude Code