fix(deps): patch js-yaml and nanoid advisories via pnpm overrides

[clay-good]

Status

Ready. Closes all 3 open Dependabot alerts (all high severity). Build green, full suite passes with zero new failures (3950 passing), flake hash regenerated and verified.

What was wrong

Three high-severity advisories sat open in the dependency tree:

Alert	Advisory	Package	Vulnerable	Provenance	Scope
#96	GHSA-5p4m-2wfm-xmqj	js-yaml 4.3.0	>=4.0.0 <4.3.1	@changesets/parse	dev
#97	GHSA-5p4m-2wfm-xmqj	js-yaml 3.15.0	>=3.0.0 <3.15.1	read-yaml-file ← changesets	dev
#99	GHSA-2v37-7h3g-55p8 / CVE-2026-67213	nanoid 3.3.16	<3.3.17	postcss	dev + website build

• js-yaml (quadratic-CPU blowup resolving a malicious !!omap): reachable only through the @changesets toolchain, which parses in-repo changeset files. The published CLI uses yaml, not js-yaml — js-yaml is never bundled.
• nanoid (infinite loop when a custom generator is called with size: 0): pulled transitively by postcss in both the root (dev, via vitest→vite) and website (build-time, via Next.js) trees. postcss only ever calls the default nanoid(6) — never the vulnerable customAlphabet/customRandom with size 0 — so the flaw is not actually reachable here. The root also carried nanoid@3.3.16 un-alerted; fixed too.

Real-world exposure for this repo is low (dev/build tooling, no untrusted input), but the alerts are worth clearing for a clean posture and defense-in-depth.

How it was fixed

pnpm overrides pinning each package to a patched floor, added to all four override surfaces (root + website, each in pnpm-workspace.yaml and package.json) to match the repo's existing sync convention:

js-yaml@>=3.0.0 <3.15.1  ->  >=3.15.1 <4
js-yaml@>=4.0.0 <4.3.1   ->  >=4.3.1 <5
nanoid@<3.3.17           ->  >=3.3.17 <4

Range values (not exact pins) match the existing brace-expansion/postcss style and let future patch releases float in. Each YAML entry is annotated with its advisory id and the removal condition (pnpm why …).

Resolved versions after pnpm install: js-yaml 3.15.1 / 4.3.1, nanoid 3.3.18 — zero residual vulnerable versions in either lockfile.

Proof it works

• Remediation: grep of both lockfiles shows no js-yaml@3.15.0, js-yaml@4.3.0, or nanoid@3.3.16 remaining; pnpm audit drops from 3 highs to 0.
• No regressions: npm run build succeeds; vitest run → 3950 passed. The only 2 failing files (artifact-workflow, config-profile) fail identically on clean main (verified by stashing this change and re-running) — pre-existing and unrelated to dependency changes.
• Lockfiles: both stay lockfileVersion 9.0, minimal diffs (version bumps only), self-consistent under --frozen-lockfile.
• Flake: root lockfile change invalidates the pnpmDeps FOD hash; regenerated to sha256-4XXIcsL8vkAdjeDAXEl1dn+abxeNWfF9A2ZcmDZZHf0= and verified via nix build (hash-mismatch-count 0). CI's nix-flake-validate gate will re-confirm.

Notes / nits

• dependabot.yml gains a header comment documenting the two surfaces Dependabot can't manage (pnpm overrides + the Nix flake) — the mechanism this PR relies on.
• Audit scope: independently swept both trees with pnpm audit + the OSV.dev batch API — no vulnerabilities exist beyond these three. The GitHub Actions workflows are already well-hardened (every action SHA-pinned, least-privilege permissions:, no injection vectors, no pull_request_target); no changes needed. One optional follow-up noted by review: magic-nix-cache-action is upstream-deprecated (maintenance, not security).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Addressed security vulnerabilities in transitive dependencies, including js-yaml, nanoid, and fast-uri.
  • Applied compatible version constraints to improve the security of development and website tooling.

• Chores

  • Updated dependency metadata and package sources to keep installations reproducible.
  • Added maintenance notes for dependency overrides requiring periodic review and updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 57c87ee8-eb2d-4d6e-b759-4ea8847f7d6d

📥 Commits

Reviewing files that changed from the base of the PR and between 3de740d and 19a2a66.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• flake.nix

🚧 Files skipped from review as they are similar to previous changes (1)

• flake.nix

---

📝 Walkthrough

Walkthrough

The change adds pnpm overrides for vulnerable js-yaml and nanoid versions, plus a constrained fast-uri version. It updates the Nix pnpmDeps hash and documents manual maintenance for dependency overrides and flake dependencies.

Changes

Dependency override maintenance

Layer / File(s)	Summary
Dependency override pins pnpm-workspace.yaml, package.json, website/pnpm-workspace.yaml, website/package.json	The root and website configurations constrain vulnerable transitive dependency versions. Comments document advisories and dependency contexts.
Nix hash maintenance flake.nix, .github/dependabot.yml	The pnpmDeps source hash is updated. Dependabot configuration documents manual maintenance requirements.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Fission-AI/OpenSpec#1461: Updates the same dependency override configurations and the Nix dependency hash for vulnerable transitive packages.
• Fission-AI/OpenSpec#1510: Updates pnpm overrides and the Nix dependency hash, including the shared fast-uri override.
• Fission-AI/OpenSpec#1249: Modifies dependency management and refreshes the flake.nix pnpmDeps hash.

Suggested reviewers: tabishb, alfred-openspec

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main dependency security fixes implemented through pnpm overrides.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/dependabot-vulnerabilities-audit-f0f85f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying openspec-docs with    Cloudflare Pages

Latest commit:	3de740d
Status:	✅  Deploy successful!
Preview URL:	https://d47d9bb1.openspec-docs.pages.dev
Branch Preview URL:	https://claude-dependabot-vulnerabil.openspec-docs.pages.dev

View logs

[alfred-openspec]

Both lockfiles resolve only the patched js-yaml 3.15.1/4.3.1 and nanoid 3.3.18 paths, frozen installs and root/website builds pass, pnpm audit reports no known vulnerabilities, the Nix hash validates, and all hosted checks are green. Approved.