From 8df97aad1985ae707b63cd7618215de91cb1d412 Mon Sep 17 00:00:00 2001
From: Raj D <25481060+radroid@users.noreply.github.com>
Date: Tue, 22 Sep 2026 14:28:58 -0400
Subject: [PATCH] fix(deps): patch Nanoid zero-size advisory

---
 pnpm-lock.yaml      | 16 ++++++++--------
 pnpm-workspace.yaml |  7 ++-----
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e1647b9d8848..cfbbc65f8c46 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -94,7 +94,7 @@ overrides:
   form-data@4: ^4.0.6
   hono@4: ^4.13.5
   ip-address@10: ^10.3.1
-  nanoid@3: ^3.3.17
+  nanoid@3: ^3.3.18
   path-to-regexp@6: ^6.3.0
   qs@6: ^6.16.0
   shell-quote@1: ^1.9.0
@@ -8736,8 +8736,8 @@ packages:
     resolution: {integrity: sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
-  nanoid@3.3.17:
-    resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
+  nanoid@3.3.19:
+    resolution: {integrity: sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -14583,7 +14583,7 @@ snapshots:
       '@react-navigation/routers': 7.6.4
       escape-string-regexp: 4.0.0
       fast-deep-equal: 3.1.3
-      nanoid: 3.3.17
+      nanoid: 3.3.19
       query-string: 7.1.3
       react: 19.2.3
       react-is: 19.2.7
@@ -14621,7 +14621,7 @@ snapshots:
       '@react-navigation/core': 7.21.13(react@19.2.3)
       escape-string-regexp: 4.0.0
       fast-deep-equal: 3.1.3
-      nanoid: 3.3.17
+      nanoid: 3.3.19
       react: 19.2.3
       react-native: 0.86.3(@babel/core@7.29.7)(@react-native/metro-config@0.86.3(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.2.16)(bufferutil@4.1.0)(react@19.2.3)(utf-8-validate@6.0.6)
       standard-navigation: 0.0.7
@@ -14629,7 +14629,7 @@ snapshots:
 
   '@react-navigation/routers@7.6.4':
     dependencies:
-      nanoid: 3.3.17
+      nanoid: 3.3.19
 
   '@redis/bloom@6.2.1(@redis/client@6.2.1)':
     dependencies:
@@ -19622,7 +19622,7 @@ snapshots:
   mute-stream@2.0.0:
     optional: true
 
-  nanoid@3.3.17: {}
+  nanoid@3.3.19: {}
 
   negotiator@0.6.3: {}
 
@@ -20155,7 +20155,7 @@ snapshots:
 
   postcss@8.5.26:
     dependencies:
-      nanoid: 3.3.17
+      nanoid: 3.3.19
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index bb1c51611ea3..7ba5e02a6462 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -176,11 +176,8 @@ overrides:
   "form-data@4": ^4.0.6
   "hono@4": ^4.13.5
   "ip-address@10": ^10.3.1
-  # Added 2026-08-08, one commit after the sweep: astro 7.2.0 brought in a fixed
-  # nanoid@3.3.17 but left the old 3.3.12 beside it, and the restructure flipped that
-  # copy's scope from development to runtime — which took GHSA #115/#116 out from under
-  # GitHub's auto-dismiss rule and reopened them. This dedupes the two copies onto 3.3.17.
-  "nanoid@3": ^3.3.17
+  # Keep Nanoid 3 above the patched floor for its zero-size custom-generator advisory.
+  "nanoid@3": ^3.3.18
   "path-to-regexp@6": ^6.3.0
   "qs@6": ^6.16.0
   "shell-quote@1": ^1.9.0