fix(security): update transitive nanoid for CVE-2026-67213

[seonghobae]

Problem

Protected main still resolves nanoid@3.3.16, affected by GHSA-2v37-7h3g-55p8 / CVE-2026-67213 (<3.3.17). The vulnerable package is transitive through postcss@8.5.25, whose declared range accepts the patched 3.3.17. Until the protected branch integrates the bounded remediation, direct-main PRs that inherit main continue to fail npm audit --audit-level=high even when their own tests are green.

Do not weaken npm audit, lower severity, add an ignore/VEX waiver, or duplicate the lockfile fix across unrelated branches.

Active root remediation

PR #76 is the canonical remediation line.

Fresh source identity:

• protected/base main: 9adb784902cae19a150146a8fadd6a0491f67814;
• PR fix(security): update transitive nanoid for CVE-2026-67213 #76 exact head: e0106ce16b7b8b493f46bf075ec5baf58762bd95;
• package-lock delta: existing node_modules/nanoid object only, 3.3.16 -> 3.3.17 plus the corresponding registry URL and integrity value;
• PostCSS declaration remains unchanged.

The branch also binds its own CI/reviewer checkout to the immutable PR head and fixed Node/npm execution identity rather than treating a moving runtime as dependency evidence.

Current exact-head proof for #76

All three PR-associated workflows for unchanged exact head e0106ce16b7b8b493f46bf075ec5baf58762bd95 are terminal success:

• application ci run 31252585269: exact-head checkout/assertion, Node 24.19.0, npm 11.17.0, frozen install, 62 test files / 646 tests, configured 100% statements/branches/functions/lines, and npm audit --audit-level=high with 0 vulnerabilities;
• reviewer-ci run 31252585267: terminal success under its own exact-head verification and reviewer quality gates;
• central Security Scan run 31252585268: terminal success, with OSV explicitly comparing base 9adb784... to exact head e0106c...; its Trivy synthetic-merge result remains integration evidence rather than being mislabeled exact-head evidence.

Current CodeRabbit findings on #76 are resolved/outdated after revalidation. Formal review evidence remains COMMENTED only; no qualifying non-author APPROVED review is present.

Fresh collaborator probes still show opencode-agent has repository permission none; cwl-noema-review has no usable collaborator permission. Those previously rejected routes are not retried until eligibility changes.

Repository-wide impact still visible

PR #69 exact head 0689fa6933dfc8db89abd053427a78a45455c86c passed 82 test files / 873 tests with configured 100% statements/branches/functions/lines, then failed only when release:verify reached npm audit --audit-level=high and found nanoid <3.3.17 inherited from protected main.

The same inherited boundary affects direct-main #65/#71/#72/#85/#86/#88 until #76 integrates. Stacked #87/#89/#80 deliberately inherit #76 and can prove their unique work without copying the lockfile remediation.

Post-#76 integration fan-out / overlap RCA

A fresh changed-file and three-way-ancestry audit shows that simply merging #76 is not enough: dependent branches must be refreshed in an order that preserves later control-plane and documentation changes. Old checks/reviews do not transfer.

First protected-lineage controls after #76

• build(reproducibility): restack deterministic npm controls after nanoid #89 package-manager/install-script control should be integrated early after fix(security): update transitive nanoid for CVE-2026-67213 #76 because it changes .github/workflows/ci.yml, package.json, vitest.config.ts, test/workflow-readiness.test.ts, and CHANGELOG.md and establishes the deterministic Node/npm/lockfile baseline future PRs must preserve.
• fix(governance): audit independent approval requirement #87 governance/agent guidance may stabilize independently from build(reproducibility): restack deterministic npm controls after nanoid #89 because its unique files are AGENTS.md, scripts/lib/main-governance-audit.mjs, and test/main-governance-audit.test.ts.
• fix(governance): audit independent approval requirement #87 and build(reproducibility): restack deterministic npm controls after nanoid #89 therefore have no direct production-file overlap and can be refreshed/integrated in whichever order the live protected lineage safely permits after fix(security): update transitive nanoid for CVE-2026-67213 #76.

PRs that must refresh after #89 or reconcile its controls

• fix(acquisition): authenticate data-room manifest evidence #69 overlaps build(reproducibility): restack deterministic npm controls after nanoid #89 on .github/workflows/ci.yml, package.json, vitest.config.ts, test/workflow-readiness.test.ts, and CHANGELOG.md. fix(acquisition): authenticate data-room manifest evidence #69 currently has the older Node-major / plain npm ci CI shape, while build(reproducibility): restack deterministic npm controls after nanoid #89 has exact Node 24.19.0 / npm 11.17.0, live-base lockfile control and explicit install flags. fix(acquisition): authenticate data-room manifest evidence #69 must be rebuilt/refreshed after build(reproducibility): restack deterministic npm controls after nanoid #89 so acquisition exact-head checks are added on top of the deterministic package-manager baseline rather than overwriting it.
• feat(operations): audit GitHub Actions runner assignment #88 overlaps build(reproducibility): restack deterministic npm controls after nanoid #89 on package.json and CHANGELOG.md; its operations:runner-assignment script must be replayed on top of build(reproducibility): restack deterministic npm controls after nanoid #89's package-manager metadata without dropping either contract.
• fix(security): make product publisher branch creation atomic #80 overlaps build(reproducibility): restack deterministic npm controls after nanoid #89 on CHANGELOG.md and overlaps fix(governance): audit independent approval requirement #87 on AGENTS.md. fix(security): make product publisher branch creation atomic #80 must therefore come only after the protected lineage contains both the fix(governance): audit independent approval requirement #87 governance/guidance correction and build(reproducibility): restack deterministic npm controls after nanoid #89 package-manager/changelog control, then replay only its unique scheduler/publisher/NIM work.

Other dependent lines

• docs: establish canonical product and trust-boundary documentation #71 canonical docs must refresh after the protected baseline moves; its docs currently truthfully describe build(reproducibility): restack deterministic npm controls after nanoid #89/fix(governance): audit independent approval requirement #87 as active Proposed owners and must update maturity after integration rather than silently retaining active-PR claims.
• fix(security): claim verified OIDC replay before token mint #83 remains write-deferred behind moving docs: establish canonical product and trust-boundary documentation #71 because it changes shared credential-exchange source; after docs: establish canonical product and trust-boundary documentation #71 integrates, replay only fix(security): claim verified OIDC replay before token mint #83's unique replay-before-token-mint repair.
• docs(api): inventory and document non-conflicting TypeScript API #86 overlaps credential-exchange public JSDoc/source with fix(security): claim verified OIDC replay before token mint #83 and already requires the security(replay): claim verified OIDC use before GitHub token creation #81/fix(security): claim verified OIDC replay before token mint #83 replay repair on protected lineage; it should refresh after fix(security): claim verified OIDC replay before token mint #83.
• feat(sandbox): add quarantined patch validation #65 → feat(sandbox): build and verify patch-validator image #67 remains its own product/supply-chain stack; feat(sandbox): add quarantined patch validation #65 must refresh from the post-fix(security): update transitive nanoid for CVE-2026-67213 #76 protected base, then feat(sandbox): build and verify patch-validator image #67 from the refreshed feat(sandbox): add quarantined patch validation #65. feat(sandbox): build and verify patch-validator image #67 branch is currently owned by another active writer in the present invocation and is not mutated here.
• docs(security): establish coordinated vulnerability disclosure #72/fix(review): authorize private target PR lookup with Noema App #85 are direct-main isolated security/reviewer slices except for shared CHANGELOG.md; refresh them from the then-current protected base and preserve accumulated ## Unreleased entries.

Current convergence sketch:

#76
├─ #87 ─┐
├─ #89 ─┼─> #80
│       ├─> #69
│       └─> #88
├─ #71 -> #83 -> #86
├─ #65 -> #67
├─ #72
└─ #85

This is a current dependency/overlap plan, not timeless architecture. Recompute exact ancestry and changed-file overlap after every protected merge or branch movement.

Acceptance criteria

Repository-owned remediation

• Keep the remediation minimal and deterministic: nanoid@3.3.17 without unrelated lock metadata churn.
• Preserve PostCSS's existing compatible dependency declaration.
• Keep frozen install and npm audit --audit-level=high unchanged.
• Record exact toolchain/source/evidence semantics in authoritative doctoring and ## Unreleased CHANGELOG.
• Verify unchanged fix(security): update transitive nanoid for CVE-2026-67213 #76 exact head with application CI, reviewer CI and Security Scan.
• Resolve/revalidate all current source-review findings without waiver or protection bypass.

Merge / protected-main acceptance

• Prove the live main ruleset/governance required by issue chore(governance): protect main and enforce release checks #27 is enforceable, including required current evidence and direct-push/break-glass controls.
• Satisfy the qualifying independent non-author formal-review requirement under live Noema/CWL governance; issue chore(operations): provision and activate hourly maintainer App #29 owns Reviewer/Maintainer App provisioning where selected.
• Merge the unchanged approved fix(security): update transitive nanoid for CVE-2026-67213 #76 exact head without weakening gates.
• Refetch protected main and verify integrated nanoid@3.3.17 plus clean npm audit --audit-level=high.
• Refresh dependent branches from the integrated protected lineage using the current overlap graph, preserving all unique files/contracts and reacquiring exact-head/security/review evidence.
• Recompute the graph after every protected integration; never assume the above historical heads remain current.

Safety boundary

Do not create/reuse .github/workflows/repair-*, self-modifying Actions, PR-branch patch workflows, write-capable one-shot finalizers, audit waivers, severity reductions, synthetic approval, destructive rebase/force push, or no-op churn merely to retrigger checks/reviews.

Related: #27, #29, #65, #67, #69, #71, #72, #76, #77, #79, #80, #83, #85, #86, #87, #88, #89

[seonghobae]

Fresh exact-head evidence for PR #72 is now available. After re-reading #72 at exact head e5db307d54675914640f03e5b92695bc57664d39, CI run 31176784943 was rerun against its current synthetic merge ref. Fresh job 93022815503 completed failure: all 62 test files / 647 tests passed and production coverage remained 100% for statements, branches, functions, and lines, then npm audit --audit-level=high failed solely on nanoid <3.3.17 / GHSA-2v37-7h3g-55p8. This makes #72, like #65/#67/#69/#71, currently blocked by this dependency-security gate. The failed rerun is evidence only; it does not authorize a waiver, ignore, merge, or release.

[seonghobae]

Additional source-bound remediation evidence (2026-08-08 UTC): the npm registry metadata for nanoid@3.3.17 reports tarball https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz, SHA-1 f1c3aa253c52547956a52c50bff754316f61037a, and SRI sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==; registry metadata also exposes an npm signature and SLSA provenance attestation URL. The live fix/nanoid-cve-2026-67213 ref was re-read immediately before this note and remains identical to main at 9adb784902cae19a150146a8fadd6a0491f67814, so no code write has been attributed to that branch yet. The safe intended lockfile delta remains exactly the node_modules/nanoid resolution 3.3.16 -> 3.3.17 (resolved URL + SRI), leaving PostCSS's declared ^3.3.16 range unchanged. No audit waiver, dynamic repair workflow, protection bypass, or stale-head evidence is authorized.

[seonghobae]

2026-08-09 fresh remediation mapping: PR #76 exact head e0106ce16b7b8b493f46bf075ec5baf58762bd95 is now the canonical implementation for this issue. It contains the minimal node_modules/nanoid lock resolution 3.3.16 → 3.3.17 without the previously rejected unrelated npm metadata rewrites, preserves PostCSS's declared ^3.3.16 range, leaves npm audit --audit-level=high unchanged, and binds application/reviewer CI to exact-head checkout plus Node 24.19.0 / npm 11.17.0. Its current exact-head ci run 31252585269, reviewer-ci run 31252585267, and central Security Scan run 31252585268 are terminal-success; application CI reports 0 audit vulnerabilities and 646 tests with 100% configured production statement/branch/function/line coverage. #75 should therefore remain open for governance/integration only: #76 still lacks an eligible independent approval and issue #27's enforceable main protection evidence. A fresh auto-merge feasibility probe could not arm auto-merge under the intended ruleset. Do not reopen dependency source changes or weaken audit merely to bypass those external gates.