chore(deps): override nanoid to 3.3.17; ignore unfixable image-size DoS CVEs - #3241
Merged
Conversation
…oS CVEs Trivy's vulnerability DB refreshed on 2026-08-08 and three new HIGH findings began failing `Trivy Filesystem Scan` on every PR resolved after the refresh. PRs scanned before it stayed green, which makes the failure look selective — it is not, and it will redden main on the next push regardless. Same pattern as CVE-2026-59870 (js-yaml) during the previous release round. The three split cleanly by whether a fix exists and whether we ship the code: nanoid 3.3.16 — CVE-2026-67213 (infinite loop), fixed in 3.3.17 / 5.1.6. Pulled in by @react-navigation/native, a RUNTIME dependency of apps/mobile, so this one genuinely ships to devices. Closed with a pnpm override, upper-bounded `<4.0.0` so it stays a 3.3.16 -> 3.3.17 patch bump rather than resolving to 6.x and moving react-navigation a major version — the same bounding rationale used for the js-yaml override. The tree's other copies (5.1.16, 6.0.0) are already past the advisory's fixed versions and are untouched; the lockfile diff is 2 lines. image-size 1.2.1 — CVE-2025-71329, CVE-2025-71330 (DoS via crafted image / ICNS). NO fixed version exists upstream: Trivy reports both as `affected` with an empty "Fixed Version" column, so no override can close them. Sole dependent is metro@0.84.4, the React Native bundler — build-time only, never in a shipped image and never on a server or customer device. Added to .trivyignore with the full justification and explicit removal criteria. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Deploying breeze with
|
| Latest commit: |
03adada
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://0c5b2ac3.breeze-9te.pages.dev |
| Branch Preview URL: | https://fix-trivy-nanoid-imagesize.breeze-9te.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks the PR queue. Trivy's vulnerability DB refreshed on 2026-08-08 and three new HIGH findings began failing
Trivy Filesystem Scanon every PR resolved after the refresh — currently #3235 and #3238.This is not caused by any of those PRs. #3232 was scanned before the refresh and passed, which makes the failure look selective; it isn't, and it will redden
mainon the next push regardless of what gets merged. Exact repeat of the CVE-2026-59870 (js-yaml) episode in the previous release round.The three findings, and why they're handled differently
nanoid3.3.16image-size1.2.1.trivyignoreimage-size1.2.1.trivyignorenanoid — fixed properly
Reached via
@react-navigation/native@7.3.8, which is a runtime dependency ofapps/mobile, so this one genuinely ships to devices. Override is upper-bounded>=3.3.17 <4.0.0so it stays a 3.3.16 → 3.3.17 patch bump rather than resolving to 6.x and dragging react-navigation through a major — the same bounding rationale used for the js-yaml override.The tree's other copies (5.1.16, 6.0.0) are already past the advisory's fixed versions and are untouched. Lockfile diff is 2 lines,
nanoid@3.3.16removed:image-size — ignored, with justification
There is no fixed version upstream. Trivy reports both as
affectedwith an empty "Fixed Version" column, so no override or upgrade can close them today.Sole dependent is
metro@0.84.4— the React Native bundler. Confirmed nothing else in the tree pulls it. metro runs on developer machines and in CI, never in a shipped image and never on a server or customer device. Both CVEs are DoS via a crafted image (a malformed ICNS for -71330) parsed byimage-size; reaching that path means feeding a hostile image to our own bundler during our own build, i.e. the attacker already controls the source tree.The
.trivyignoreentry records the dependent, the non-exploitability argument, and explicit removal criteria — matching the justification standard the file already sets for its existingnode-ipand pnpm blocks. All 9 pre-existing entries are preserved; this appends 2.Release note
Worth a line in the v0.104.0 notes alongside the js-yaml entry: nanoid is a real (if low-severity) fix that reaches the mobile app; image-size is a documented, non-shipping accept.
🤖 Generated with Claude Code