Skip to content

chore(deps): minor-patch group, and floor nanoid to clear GHSA-2v37-7h3g-55p8 - #87

Merged
vvillait88 merged 2 commits into
mainfrom
dependabot/bun/minor-patch-125a6f09de
Aug 10, 2026
Merged

chore(deps): minor-patch group, and floor nanoid to clear GHSA-2v37-7h3g-55p8#87
vvillait88 merged 2 commits into
mainfrom
dependabot/bun/minor-patch-125a6f09de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Dependabot's grouped minor-patch bump (lockfile only), plus the fix for the advisory that was failing this PR's Dependency Scan.

nanoid 3.3.16 carries a HIGH (8.2) advisory, GHSA-2v37-7h3g-55p8, fixed in 3.3.17. It reaches this repo transitively through postcss under the build tooling. postcss already declares "^3.3.16", so the fix was inside its range; the reason a re-install did not take it is that bun does not re-resolve a locked version that still satisfies its range. An override floor takes it, resolving to 3.3.18.

postcss is build tooling rather than a runtime dependency, so no published package or compiled binary ever carried the vulnerable copy. Nothing needs republishing for this.

Deliberately not in this PR

  • viem 2.55.10 to 2.55.13, the coupled settle set. The agent, the verifier and every merchant must move together or zero-amount proof verification disagrees between them, and a coupled bump owes a live all-rails settle. That is its own change with its own verification.
  • incur stays at its patched pin. A bump silently detaches patches/incur@0.4.26.patch, which is what lets the compiled binary resolve its MCP transport, and it owes the serveCli protocol run against the compiled binary rather than the node dist.
  • eslint 10 and typescript 7, both held at their current majors as deliberate org-wide upgrade passes.

Type of change

  • Bug fix (no breaking change)
  • New feature (no breaking change)
  • Breaking change (existing callers must update)
  • Docs, tests, or internal maintenance only

Public API

None. No command, flag, output shape, or exported type changes. The nanoid floor affects a transitive build-tooling package only.

Test plan

Run locally on this branch, all green: bun run typecheck, bun run lint, bun run test (570 passed, 2 skipped), and bun run build. The lock resolves nanoid@3.3.18, and incur remains at its patched pin with the patch still attached.

Checklist

  • Tests cover the new behavior, and the suite passes locally
  • Lint, format, and type checks pass
  • Docs and README examples updated if the public surface changed
  • No secrets, credentials, or personal data in the diff or the tests

Bumps the minor-patch group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@scure/bip39](https://github.com/paulmillr/scure-bip39) | `2.2.0` | `2.3.0` |
| [@x402/core](https://github.com/x402-foundation/x402) | `2.20.0` | `2.21.0` |
| [@x402/evm](https://github.com/x402-foundation/x402) | `2.20.0` | `2.21.0` |
| [@x402/fetch](https://github.com/x402-foundation/x402) | `2.20.0` | `2.21.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.31.0` | `6.32.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.5` | `4.23.11` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.66.0` |


Updates `@scure/bip39` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/paulmillr/scure-bip39/releases)
- [Commits](paulmillr/scure-bip39@2.2.0...2.3.0)

Updates `@x402/core` from 2.20.0 to 2.21.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/core@v2.20.0...npm-@x402/core@v2.21.0)

Updates `@x402/evm` from 2.20.0 to 2.21.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/evm@v2.20.0...npm-@x402/evm@v2.21.0)

Updates `@x402/fetch` from 2.20.0 to 2.21.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/fetch@v2.20.0...npm-@x402/fetch@v2.21.0)

Updates `@types/node` from 26.1.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `knip` from 6.31.0 to 6.32.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.32.0/packages/knip)

Updates `tsx` from 4.23.5 to 4.23.11
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.5...v4.23.11)

Updates `typescript-eslint` from 8.65.0 to 8.66.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@scure/bip39"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@x402/core"
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@x402/evm"
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@x402/fetch"
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: knip
  dependency-version: 6.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: tsx
  dependency-version: 4.23.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: typescript-eslint
  dependency-version: 8.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
nanoid 3.3.16 carries a HIGH (8.2) advisory fixed in 3.3.17, reaching this
repo transitively through postcss under the build tooling. postcss already
declares "^3.3.16", but bun does not re-resolve a locked version that
still satisfies its range, so a plain install leaves 3.3.16 and the scan
keeps failing. The floor takes it, resolving to 3.3.18. Build tooling
only, so no published binary or package carried the vulnerable copy.

Deliberately not moved: viem 2.55.10 -> 2.55.13, which is the coupled
settle set. The agent, the verifier and every merchant move together, and
a coupled bump owes a live all-rails settle, so it is its own change.
incur stays at its patched pin: a bump detaches patches/incur@0.4.26.patch
and owes the serveCli protocol against the compiled binary.

eslint 10 and typescript 7 stay held per the standing org-wide position.

Verified: typecheck, lint, 570 tests and build all green.
@vvillait88 vvillait88 changed the title chore(deps): bump the minor-patch group with 8 updates chore(deps): minor-patch group, and floor nanoid to clear GHSA-2v37-7h3g-55p8 Aug 10, 2026
@vvillait88
vvillait88 merged commit 587f96d into main Aug 10, 2026
6 checks passed
@vvillait88
vvillait88 deleted the dependabot/bun/minor-patch-125a6f09de branch August 10, 2026 19:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant