fix(dev-1699): bump nanoid to 3.3.18 - #70
spur-vuln-author[bot] wants to merge 1 commit into
Conversation
|
Escalating: Gate 3 (diff equivalence) mechanically FAILed. gate3-check.sh: GATE3 FAIL target=nanoid manifest=pnpm-lock.yaml pr_version=? required=3.3.18 alerts=110,111,113 extra_files=1 state=open. Detail: the helper has no extraction rule for ecosystem=npm manifest basename=pnpm-lock.yaml, so it could not extract the new nanoid version from the diff, and flagged package.json as a file outside {manifest, lockfile} (which is actually the expected direct-dependency file for an npm/pnpm version bump). This looks like a tooling gap in gate3-check.sh (no pnpm-lock.yaml parser) rather than a real diff deviation, but per the review contract a mechanical Gate 3 FAIL is never re-derived or second-guessed by the reviewer. Required version per max open Dependabot alert(s) 110,111,113: 3.3.18. Not merged. A human must review this. This reviewer will not act on this PR again. [[spur-vuln-reviewer: escalated diff-mismatch-constructed]] |
spur-vuln-reviewer
Bot
added
the
hitl
Context
Batched group (ticket_group_key
tg:nanoid:pnpm-lock.yaml, 3 advisories) againstnanoid, all inpnpm-lock.yaml:Transitive dependency (not declared in any package.json), resolved via
pnpm-lock.yaml. No Dependabot PR exists for any of these, so this PR was constructed directly from the highestfirst_patched_versionacross the group (3.3.18).Test evidence
No Dependabot PR existed; constructed from first_patched_version 3.3.18 (highest across the batch). Added a
pnpm.overridesentry and regenerated the lockfile withpnpm install --lockfile-only. Confirmed via lockfile inspection thatnanoidnow resolves to3.3.19(previously3.3.11/3.3.12), satisfying >= 3.3.18 for all three advisories. Companion-file scan (Dockerfiles,.nvmrc,go.mod, CI workflow YAML, etc. hardcoding3.3.11) found no hits.Risk
Low. Lockfile-only transitive dependency bump within the same major version line, resolves all 3 batched advisories at once. Group max severity high; Tier 1 / 90-day SLA.