Skip to content

fix(security): bump pdfjs-dist 6.2.108 (CVE-2026-16633), undici >=7.29.0, nanoid 3.3.18 #1023

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 1 commit into from
Closed

fix(security): bump pdfjs-dist 6.2.108 (CVE-2026-16633), undici >=7.29.0, nanoid 3.3.18 #1023

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/desktop/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
"class-variance-authority": "^0.7.1",
"clsx": "^2.1.1",
"lucide-react": "^1.24.0",
"pdfjs-dist": "6.1.200",
"pdfjs-dist": "6.2.108",
"react": "^19.2.4",
"react-dom": "^19.2.7",
"sonner": "^2.0.7",
Expand Down
46 changes: 10 additions & 36 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
},
"overrides": {
"brace-expansion": "5.0.9",
"postcss": "8.5.25"
"postcss": "8.5.25",
"undici": "^7.29.0"

@devin-ai-integration devin-ai-integration Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: undici override uses a caret, siblings pin exact versions

The new override undici: "^7.29.0" (package.json) is a caret range, while brace-expansion and postcss next to it pin exact versions. It stays bounded below 8.0.0 and the lockfile resolves 7.29.0, so behavior is fine today, but it can float within 7.x on a future lockfile regeneration.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Comment on lines +40 to +41

@devin-ai-integration devin-ai-integration Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: nanoid fix enforced only by the lockfile

The nanoid 3.3.18 remediation was applied by bumping the lockfile, with no override added. nanoid is transitive via postcss (range ^3.3.x), so regeneration still resolves >=3.3.18 and the fix holds. The remediation rests on the committed lockfile alone, not a pin.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

}
}
Loading