Update nanoid from 3.3.4 to 3.3.8

[zeropath-ai-staging]

Summary

Transitive dependency nanoid@3.3.4 has a security vulnerability (GHSA-mwcw-c2x4-8c55).

Fixed version available: 3.3.8

Verified Parent Upgrade Options (queried from package registry):

1. postcss: 8.4.14 → 8.4.15 (patch bump, includes nanoid@unknown)
2. postcss: 8.4.14 → 8.4.16 (patch bump, includes nanoid@unknown)
3. postcss: 8.4.14 → 8.4.17 (patch bump, includes nanoid@unknown)

Task:

1. Update the parent dependency in the manifest file (option 1, smallest version bump)
2. Update the lock file (if present) to reflect the new parent version and resolve transitive dependencies

The parent version shown above was verified via package registry to include nanoid@3.3.8.

Important: You must update BOTH files:

• Manifest: owasp-top10-2021-apps/a4/super-recovery-password/src/app/package.json (change parent dependency version)
• Lock file: package lock file (update resolved dependencies)

For the lock file, you'll need to:

• Find the parent package entry
• Update its version
• Find/update the nanoid entry under the parent's dependencies
• Set it to version 3.3.8 or later
• REMOVE any 'integrity' fields completely (DELETE the line - do NOT set to empty string)

View in dashboard

Vulnerability Details

• Vulnerability Class: GHSA-mwcw-c2x4-8c55
• Severity: 0.0
• Affected File: owasp-top10-2021-apps/a4/super-recovery-password/src/app/package-lock.json
• Vulnerable Lines: 1-1

Code Changes

diff --git a/owasp-top10-2021-apps/a4/super-recovery-password/src/app/package.json b/owasp-top10-2021-apps/a4/super-recovery-password/src/app/package.json
--- a/owasp-top10-2021-apps/a4/super-recovery-password/src/app/package.json
+++ b/owasp-top10-2021-apps/a4/super-recovery-password/src/app/package.json
@@ -12,7 +12,10 @@
     "react-router-dom": "^6.3.0",
     "react-scripts": "5.0.1",
     "styled-components": "^5.3.5",
-    "web-vitals": "^2.1.4"
+    "web-vitals": "^2.1.4",
+    "nanoid": "^3.3.8",
+    "nanoid": "^3.3.8",
+    "nanoid": "^3.3.8"
   },
   "scripts": {
     "start": "react-scripts start",

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai!

To request modifications, please post a comment beginning with @zeropath-ai and specify the changes required.

@zeropath-ai will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_ad69a273

# if vscode is installed run (or use your favorite editor / IDE):
code owasp-top10-2021-apps/a4/super-recovery-password/src/app/package-lock.json

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_ad69a273