From 098cda8fc69a5078d20310eb3a0c849cacdc2720 Mon Sep 17 00:00:00 2001
From: Cristian Magherusan-Stanciu <cristi.magherusan@gmail.com>
Date: Sat, 8 Aug 2026 01:05:05 +0200
Subject: [PATCH] chore(frontend): patch js-yaml and nanoid advisories

Two new high-severity npm advisories appeared since #1716 patched
brace-expansion and fast-uri, reddening `npm audit --audit-level=high`
on main and every open PR:

- js-yaml (GHSA-5p4m-2wfm-xmqj): quadratic CPU consumption in !!omap
  resolution, pulled in transitively by eslint and by ts-jest's
  @istanbuljs/load-nyc-config.
- nanoid (GHSA-2v37-7h3g-55p8): custom generators can loop indefinitely
  when size is zero, pulled in transitively by css-loader's postcss.

Neither package is a direct dependency; both resolve within the existing
semver ranges declared by their parents. `npm audit fix` bumped only the
three affected lockfile entries (js-yaml 3.15.0 to 3.15.1, js-yaml 4.3.0
to 4.3.1, nanoid 3.3.16 to 3.3.18) with no change to package.json.

Verified `npm audit --audit-level=high` exits 0 after the fix, `npm run
build` succeeds, and the test suite is no worse: 8 failed / 2773 passed
/ 1 skipped, identical on this branch and on unmodified origin/main. The
8 failures are a pre-existing host-locale thousands-separator mismatch
in riexchange.test.ts / approval-details.test.ts, filed as #1728.

Refs #1712
---
 frontend/package-lock.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 84f09122d..c71bb9e13 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -2041,9 +2041,9 @@
       }
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.15.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
-      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
+      "version": "3.15.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz",
+      "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8331,9 +8331,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -8903,9 +8903,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {