From 163e9151d44835802453d1244837e8c1a0002a6f Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 08:42:00 +0000 Subject: [PATCH 1/2] chore: upgrade nanoid to ^3.3.18 to address CVE-2026-67213 Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 8c17cdd19..83513e5ba 100644 --- a/yarn.lock +++ b/yarn.lock @@ -18442,11 +18442,11 @@ __metadata: linkType: hard "nanoid@npm:^3.3.16": - version: 3.3.16 - resolution: "nanoid@npm:3.3.16" + version: 3.3.18 + resolution: "nanoid@npm:3.3.18" bin: nanoid: bin/nanoid.cjs - checksum: 10c0/bbf2dcffe22d2b62d16de2711752070b539c0f644c7916f823ad6521986b2078cbe524f2d6240f58c46e9141ea0c7b87a029e100c0f7f175228cacaf30e41bba + checksum: 10c0/b994b4e396730f8be2520923284e2040d61eaee55cc6d4935ef6d38d34bafdc46133eda4d3faea5073bda545aa6079d82b886caeac5c731cf9ac18bcc1301425 languageName: node linkType: hard From 3271c46190ed6f3ded9136d5111f1bd9eb3a4b4e Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 08:42:17 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for nanoid upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a3335d4cd..e6dd08948 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,6 +28,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - [EE] Fixed Ask MCP connector tools failing to load when their input schemas use JSON Schema 2019-09 or 2020-12. [#1547](https://github.com/sourcebot-dev/sourcebot/pull/1547) - Upgraded `js-yaml` to `^4.3.1`. [#1552](https://github.com/sourcebot-dev/sourcebot/pull/1552) - Upgraded `reo-census` to `^1.2.10` in `setup-sourcebot`. [#1554](https://github.com/sourcebot-dev/sourcebot/pull/1554) +- Upgraded `nanoid` to `^3.3.18`. [#1557](https://github.com/sourcebot-dev/sourcebot/pull/1557) ## [5.1.5] - 2026-07-31