From cf472cf77fb93325858f485a22e967449d7c387a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:54:13 +0900 Subject: [PATCH 1/3] docs(agents): add CWL-ENTRY read-first block .github's AGENTS.md carries a block pointing agents at the master context, live GitHub Project, and gap snapshot before any work. naruon never had this block (it only has a naruon-specific cwl-agent-guidance section below it), so agents landing here had no equivalent pointer. Add naruon's own version, wired to naruon's real docs: docs/architecture/naruon-product-spec.md for mission/architecture, the existing docs/product-technical-gap-baseline.md gap snapshot, and a cross-repo link to .github's agent-github-project-protocol.md and product-goal-directive.md, which are genuinely org-wide and not duplicated per repo. The Figma file ID line reflects naruon's actual current state (not yet canonical on develop; ADR-0013 is still in open PR #1436) rather than the N/A placeholder that would make no sense for a repo that has UI. Co-Authored-By: Claude Sonnet 5 --- AGENTS.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 9104dd1f4..ec36650bf 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,5 +1,8 @@ # AGENTS.md + +> **Agents: read the master context FIRST.** Before any work, read [`docs/architecture/naruon-product-spec.md`](docs/architecture/naruon-product-spec.md) (product vision & architecture, RBAC/ABAC, core features & AI agent ontology, branding/UX, observability & governance), the live **GitHub Project #1** (work/roadmap source of truth), the live gap snapshot [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) (not merge authorization; canonical completion issue [#1428](https://github.com/ContextualWisdomLab/naruon/issues/1428); this repo's Figma file ID is not yet canonical on `develop` — the design-system decision (ADR-0013, file ID `68b5XB58w8nwT2LYOOnikK`) is still in open PR [#1436](https://github.com/ContextualWisdomLab/naruon/pull/1436)), and operate the Project per `ContextualWisdomLab/.github`'s [`docs/agent-github-project-protocol.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth. The standing autonomous operating directive for the continuous PR review→fix→merge→develop loop across the ecosystem is `ContextualWisdomLab/.github`'s [`docs/product-goal-directive.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/product-goal-directive.md) — a `/goal` session's length-capped pointer refers to it; read the full directive before running or configuring any such loop. + ## Agent guidance (CWL governance) From 57254cb61ecc67dd593ea96ae878bf651682a501 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 05:50:11 +0900 Subject: [PATCH 2/3] docs(agents): make repository entry verifiable Format the CWL entry as a readable source checklist and add a governance regression for the product spec, Project, gap baseline, completion issue, Figma proposal, and central operating documents.\n\nAssisted-by: OpenAI Codex --- AGENTS.md | 10 +++++++++- backend/tests/test_release_governance.py | 14 ++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index ec36650bf..2f0a02442 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,7 +1,15 @@ # AGENTS.md -> **Agents: read the master context FIRST.** Before any work, read [`docs/architecture/naruon-product-spec.md`](docs/architecture/naruon-product-spec.md) (product vision & architecture, RBAC/ABAC, core features & AI agent ontology, branding/UX, observability & governance), the live **GitHub Project #1** (work/roadmap source of truth), the live gap snapshot [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) (not merge authorization; canonical completion issue [#1428](https://github.com/ContextualWisdomLab/naruon/issues/1428); this repo's Figma file ID is not yet canonical on `develop` — the design-system decision (ADR-0013, file ID `68b5XB58w8nwT2LYOOnikK`) is still in open PR [#1436](https://github.com/ContextualWisdomLab/naruon/pull/1436)), and operate the Project per `ContextualWisdomLab/.github`'s [`docs/agent-github-project-protocol.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth. The standing autonomous operating directive for the continuous PR review→fix→merge→develop loop across the ecosystem is `ContextualWisdomLab/.github`'s [`docs/product-goal-directive.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/product-goal-directive.md) — a `/goal` session's length-capped pointer refers to it; read the full directive before running or configuring any such loop. +> **Agents: read the master context FIRST.** Before any work, read: +> +> - [`docs/architecture/naruon-product-spec.md`](docs/architecture/naruon-product-spec.md) for product vision, architecture, RBAC/ABAC, core features, AI agent ontology, branding/UX, observability, and governance; +> - the live [GitHub Project #1](https://github.com/orgs/ContextualWisdomLab/projects/1), the work and roadmap source of truth; +> - [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md), the live gap snapshot but not merge authorization, and canonical completion issue [#1428](https://github.com/ContextualWisdomLab/naruon/issues/1428); +> - `ContextualWisdomLab/.github`'s [`docs/agent-github-project-protocol.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/agent-github-project-protocol.md) for Project operation; and +> - `ContextualWisdomLab/.github`'s [`docs/product-goal-directive.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/product-goal-directive.md) before running or configuring the continuous PR review→fix→merge→develop loop. A length-capped `/goal` pointer does not replace the full directive. +> +> This repository's Figma file ID is not yet canonical on `develop`: ADR-0013 and file ID `68b5XB58w8nwT2LYOOnikK` remain Proposed in open PR [#1436](https://github.com/ContextualWisdomLab/naruon/pull/1436). The repository and Project, not private agent memory, are authoritative. ## Agent guidance (CWL governance) diff --git a/backend/tests/test_release_governance.py b/backend/tests/test_release_governance.py index a23c70746..4d879f731 100644 --- a/backend/tests/test_release_governance.py +++ b/backend/tests/test_release_governance.py @@ -601,6 +601,20 @@ def test_scorecard_sarif_normalizer_rejects_escape_links_and_large_input( assert module.main([str(normalizer), str(expected)]) == 65 +def test_agents_entry_points_to_current_product_and_governance_sources() -> None: + agents = read_repo_text("AGENTS.md") + + assert "" in agents + assert "docs/architecture/naruon-product-spec.md" in agents + assert "docs/product-technical-gap-baseline.md" in agents + assert "ContextualWisdomLab/projects/1" in agents + assert "ContextualWisdomLab/naruon/issues/1428" in agents + assert "ContextualWisdomLab/naruon/pull/1436" in agents + assert "docs/agent-github-project-protocol.md" in agents + assert "docs/product-goal-directive.md" in agents + assert "not private agent memory" in agents + + def test_review_automation_uses_central_required_workflows_without_local_copies() -> ( None ): From ee2540c9efbfa8261e5517ecfff5d37c2701fa37 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 15 Sep 2026 17:48:53 +0900 Subject: [PATCH 3/3] chore(stack): retire superseded entry prerequisite Restore the exact current #1623 dependency-security tree on this prerequisite branch. The former CWL-entry guidance/test delta remains preserved in history and is fully carried by descendant #1549, which is the active governance successor; do not merge this provenance lane independently. --- AGENTS.md | 15 ++------ CHANGELOG.md | 2 +- CLAUDE.md | 5 +++ .../test_container_dependency_pin_contract.py | 27 +++++++++++--- .../test_frontend_framework_security_floor.py | 37 +++++++++++++++++++ .../tests/test_frontend_nanoid_security.py | 2 +- backend/tests/test_release_governance.py | 14 ------- frontend/pnpm-lock.yaml | 9 +++-- frontend/pnpm-workspace.yaml | 1 + 9 files changed, 76 insertions(+), 36 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 2f0a02442..0d0fd6abc 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,16 +1,5 @@ # AGENTS.md - -> **Agents: read the master context FIRST.** Before any work, read: -> -> - [`docs/architecture/naruon-product-spec.md`](docs/architecture/naruon-product-spec.md) for product vision, architecture, RBAC/ABAC, core features, AI agent ontology, branding/UX, observability, and governance; -> - the live [GitHub Project #1](https://github.com/orgs/ContextualWisdomLab/projects/1), the work and roadmap source of truth; -> - [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md), the live gap snapshot but not merge authorization, and canonical completion issue [#1428](https://github.com/ContextualWisdomLab/naruon/issues/1428); -> - `ContextualWisdomLab/.github`'s [`docs/agent-github-project-protocol.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/agent-github-project-protocol.md) for Project operation; and -> - `ContextualWisdomLab/.github`'s [`docs/product-goal-directive.md`](https://github.com/ContextualWisdomLab/.github/blob/main/docs/product-goal-directive.md) before running or configuring the continuous PR review→fix→merge→develop loop. A length-capped `/goal` pointer does not replace the full directive. -> -> This repository's Figma file ID is not yet canonical on `develop`: ADR-0013 and file ID `68b5XB58w8nwT2LYOOnikK` remain Proposed in open PR [#1436](https://github.com/ContextualWisdomLab/naruon/pull/1436). The repository and Project, not private agent memory, are authoritative. - ## Agent guidance (CWL governance) @@ -689,6 +678,10 @@ in this repo. backend/tests/test_release_governance.py backend/tests/test_runtime_config_api.py -q`, `corepack pnpm@11.5.3 --dir frontend test --runInBand` when frontend behavior changes, and a Docker build of the affected image. +- A pnpm importer entry is only valid when both records it names exist: the + base-version key in `packages` and the complete peer-qualified key in + `snapshots`. Security-floor tests must reject a lock that retains another + compliant version while dropping the importer's own base package record. - GHCR publishing evidence for the combined `naruon` image must include the exact image name, tag, local image ID, push result, and registry verification from GitHub Packages or an equivalent manifest/API query. Publish the package diff --git a/CHANGELOG.md b/CHANGELOG.md index 7ec84c36f..1fb2dc28c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,7 +39,7 @@ - OIDC token endpoint는 운영 환경에서 서버 전용 `OIDC_ALLOWED_HOSTS` 정확 호스트 allowlist를 필수로 적용합니다. hostname의 모든 DNS 결과가 공인 주소인지 검증한 뒤 해당 주소 집합을 native HTTP(S) 연결의 `lookup`에 고정하고, 원래 issuer hostname은 Host/TLS SNI로 유지해 사설 주소 해석과 DNS rebinding 사이의 TOCTOU를 차단합니다. 실패 로그는 입력 URL·token 대신 고정된 configuration/DNS·transport/response/backend-verification reason code만 남깁니다. - Trivy 2026-07-26 DB에서 새로 확인된 Next.js High 4건·Medium 5건(`CVE-2026-64641`–`CVE-2026-64649`)과 PostCSS High 1건(`GHSA-r28c-9q8g-f849`)을 제거하기 위해 Next.js/`eslint-config-next`를 `16.2.11`, PostCSS를 `8.5.18`로 갱신했습니다. 이후 2026-08-04 DB가 `8.5.18`에서 추가 탐지한 PostCSS Medium(`CVE-2026-69153`, 최초 수정 `8.5.23`)도 제거하도록 manifest·workspace override·lock을 `8.5.24`로 동기화했으며 저장소의 release-age 정책을 우회하지 않습니다. - `pnpm audit`가 개발 도구 체인에서 추가 탐지한 `brace-expansion <=5.0.7` High DoS(`GHSA-mh99-v99m-4gvg`)와 이후 `5.0.8`까지 영향을 주는 우회형 High DoS(`GHSA-rgw5-rvv9-x895`)는 `5.0.9` 전역 override로 제거했습니다. CommonJS default export를 기대하는 legacy `minimatch 3.1.5`에는 `expand` named export도 수용하는 최소 pnpm 패치를 적용해 ESLint/glob 동작을 보존합니다. 같은 감사에서 확인된 `undici 7.28.0`의 High 1건·Moderate 4건(`GHSA-4cwx-7wf7-3272` 등)은 `jsdom 30.0.1` 및 release-age 정책을 통과하는 `undici 8.9.0`으로 갱신했습니다. -- PostCSS의 Nano ID 해석을 `3.3.18`로 갱신해 사용자 제공 음수 크기에서 비보안 생성기가 무한 반복될 수 있는 High DoS(`CVE-2026-67214`, `GHSA-28wg-ghj8-5hjv`)를 제거했습니다. lockfile과 release-governance 회귀 테스트가 같은 최초 수정 3.x 버전을 강제합니다. +- PostCSS의 Nano ID 해석을 `3.3.19`로 갱신해 사용자 제공 음수 크기에서 비보안 생성기가 무한 반복될 수 있는 High DoS(`CVE-2026-67214`, `GHSA-28wg-ghj8-5hjv`)와 후속 3.x 보안 floor를 충족합니다. workspace override·lockfile·release-governance 회귀 테스트가 같은 패치 버전을 강제합니다. - root·frontend Docker build의 frozen install 계층이 pnpm manifest와 함께 `frontend/patches`를 먼저 복사하도록 수정해, 이미지 검증에서도 lockfile의 patched dependency를 동일하게 재현합니다. - Scorecard SARIF normalizer는 고정 workspace artifact로 정규화되는 `./scorecard-results.sarif`와 절대 경로를 동일하게 허용하면서 symlink·workspace 이탈은 계속 거부합니다. 도구 실행 실패 API는 CR/LF·제어 문자를 escape하고 500자로 제한하며, 로그에는 raw 도구 코드·예외 text 대신 SHA-256 기반 코드·traceback 상관 식별자만 기록합니다. - 백엔드 origin 보안 경계를 `frontend/src/lib/backend-url.ts`의 단일 생성기로 통합해 API proxy·session·OIDC callback이 같은 검증을 사용합니다. UI smoke의 새 `NARUON_FULL_PRODUCT_SCREENSHOT_PROFILE` 이름은 실제 selector 의미를 드러내며, 기존 `..._SCREENSHOT_DIR`은 호환 alias로 계속 지원합니다. diff --git a/CLAUDE.md b/CLAUDE.md index be67bc80c..197a38766 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -55,6 +55,11 @@ pnpm run dev npm run test:e2e -- tests/e2e/dashboard-branding.spec.ts # Playwright (set LIVE_BASE_URL for live stacks) ``` +For pnpm security-floor checks, bind each root importer to its base-version +`packages` entry and its complete peer-qualified `snapshots` entry. A different +patched version elsewhere in the lockfile is not evidence for the importer's +declared resolution. + ### Whole-repo verification ```bash diff --git a/backend/tests/test_container_dependency_pin_contract.py b/backend/tests/test_container_dependency_pin_contract.py index fdd4f6620..5daf15b6e 100644 --- a/backend/tests/test_container_dependency_pin_contract.py +++ b/backend/tests/test_container_dependency_pin_contract.py @@ -19,6 +19,8 @@ REPO_ROOT = Path(__file__).resolve().parents[2] _HASH_PATTERN = re.compile(r"--hash=sha256:([0-9a-f]{64})") _EXACT_PIN_PATTERN = re.compile(r"^([A-Za-z0-9_.-]+)==([^\\\s]+)") +_EXACT_SEMVER_PATTERN = re.compile(r"^(\d+)\.(\d+)\.(\d+)$") +POSTCSS_SECURITY_FLOOR = (8, 5, 24) def read_repo_text(relative_path: str) -> str: @@ -83,6 +85,13 @@ def importer_resolution(importer_section: dict[str, object], group: str, name: s return resolution +def exact_semver(value: str) -> tuple[int, int, int]: + """Return one exact three-part semantic version for security-floor comparison.""" + match = _EXACT_SEMVER_PATTERN.fullmatch(value) + assert match is not None, f"expected exact semantic version, got {value!r}" + return tuple(int(part) for part in match.groups()) + + def test_container_provenance_dependency_pins_match_reviewed_manifests() -> None: """Keep backend, Strix, and frontend dependency floors reviewable together.""" backend_pins = exact_requirement_pins(read_repo_text("backend/requirements.txt")) @@ -94,6 +103,7 @@ def test_container_provenance_dependency_pins_match_reviewed_manifests() -> None read_repo_text("requirements-strix-ci-hashes.txt") ) frontend_package = json.loads(read_repo_text("frontend/package.json")) + frontend_workspace = yaml.safe_load(read_repo_text("frontend/pnpm-workspace.yaml")) frontend_lock = yaml.safe_load(read_repo_text("frontend/pnpm-lock.yaml")) assert backend_pins["cryptography"] == "50.0.0" @@ -116,29 +126,36 @@ def test_container_provenance_dependency_pins_match_reviewed_manifests() -> None for digest in strix_records[pin] ) + reviewed_postcss = frontend_package["devDependencies"]["postcss"] + assert isinstance(reviewed_postcss, str) + assert exact_semver(reviewed_postcss) >= POSTCSS_SECURITY_FLOOR + assert frontend_package["overrides"]["postcss"] == reviewed_postcss + assert frontend_workspace["overrides"]["postcss"] == reviewed_postcss + root_importer = frontend_lock["importers"]["."] postcss_resolution = importer_resolution( root_importer, "devDependencies", "postcss" ) jsdom_resolution = importer_resolution(root_importer, "devDependencies", "jsdom") - assert postcss_resolution == {"specifier": "8.5.24", "version": "8.5.24"} + assert postcss_resolution == { + "specifier": reviewed_postcss, + "version": reviewed_postcss, + } assert jsdom_resolution == {"specifier": "^30.0.1", "version": "30.0.1"} - assert frontend_package["devDependencies"]["postcss"] == "8.5.24" assert frontend_package["devDependencies"]["jsdom"] == "^30.0.1" - assert frontend_package["overrides"]["postcss"] == "8.5.24" assert frontend_package["overrides"]["brace-expansion"] == "5.0.9" assert frontend_package["overrides"]["undici"] == "8.9.0" assert frontend_lock["overrides"] == { **frontend_lock["overrides"], - "postcss": "8.5.24", + "postcss": reviewed_postcss, "brace-expansion": "5.0.9", "undici": "8.9.0", } package_records = frontend_lock["packages"] for exact_lock_entry in ( - "postcss@8.5.24", + f"postcss@{reviewed_postcss}", "jsdom@30.0.1", "brace-expansion@5.0.9", "undici@8.9.0", diff --git a/backend/tests/test_frontend_framework_security_floor.py b/backend/tests/test_frontend_framework_security_floor.py index c1a7e2b9b..e200c5ead 100644 --- a/backend/tests/test_frontend_framework_security_floor.py +++ b/backend/tests/test_frontend_framework_security_floor.py @@ -176,6 +176,11 @@ def test_vitest_security_floor_covers_manifest_and_lock() -> None: assert _resolved_version(str(importer_entry["version"])) == _exact_version( declared_value ), f"root importer must resolve the reviewed {package_name} release" + resolved_version = str(importer_entry["version"]) + base_version = resolved_version.split("(", 1)[0] + assert f"{package_name}@{base_version}" in lock["packages"], ( + f"root importer {package_name} resolution must reference an existing package record" + ) assert f"{package_name}@{importer_entry['version']}" in lock["snapshots"], ( f"root importer {package_name} resolution must reference an existing snapshot" ) @@ -314,3 +319,35 @@ def _read_text(path: Path, *args: Any, **kwargs: Any) -> str: monkeypatch.setattr(Path, "read_text", _read_text) with pytest.raises(AssertionError): test_vitest_security_floor_covers_manifest_and_lock() + + +@pytest.mark.parametrize("package_name", ["vitest", "@vitest/coverage-v8"]) +def test_vitest_security_floor_rejects_missing_root_package( + monkeypatch: pytest.MonkeyPatch, + package_name: str, +) -> None: + """Reject a root Vitest resolution whose base package record vanished.""" + + package_text = (FRONTEND_ROOT / "package.json").read_text(encoding="utf-8") + lock = yaml.safe_load( + (FRONTEND_ROOT / "pnpm-lock.yaml").read_text(encoding="utf-8") + ) + resolution = str( + lock["importers"]["."]["devDependencies"][package_name]["version"] + ) + package_key = f"{package_name}@{resolution.split('(', 1)[0]}" + package_record = lock["packages"].pop(package_key) + lock["packages"][f"{package_name}@4.1.12"] = package_record + lock_text = yaml.safe_dump(lock) + original_read_text = Path.read_text + + def _read_text(path: Path, *args: Any, **kwargs: Any) -> str: + if path == FRONTEND_ROOT / "package.json": + return package_text + if path == FRONTEND_ROOT / "pnpm-lock.yaml": + return lock_text + return original_read_text(path, *args, **kwargs) + + monkeypatch.setattr(Path, "read_text", _read_text) + with pytest.raises(AssertionError): + test_vitest_security_floor_covers_manifest_and_lock() diff --git a/backend/tests/test_frontend_nanoid_security.py b/backend/tests/test_frontend_nanoid_security.py index f80b23a01..66bc5b499 100644 --- a/backend/tests/test_frontend_nanoid_security.py +++ b/backend/tests/test_frontend_nanoid_security.py @@ -8,7 +8,7 @@ REPO_ROOT = Path(__file__).resolve().parents[2] FRONTEND_LOCK = REPO_ROOT / "frontend" / "pnpm-lock.yaml" -PATCHED_NANOID_VERSION = "3.3.18" +PATCHED_NANOID_VERSION = "3.3.19" def test_frontend_lock_resolves_only_patched_nanoid_3x() -> None: diff --git a/backend/tests/test_release_governance.py b/backend/tests/test_release_governance.py index 4d879f731..a23c70746 100644 --- a/backend/tests/test_release_governance.py +++ b/backend/tests/test_release_governance.py @@ -601,20 +601,6 @@ def test_scorecard_sarif_normalizer_rejects_escape_links_and_large_input( assert module.main([str(normalizer), str(expected)]) == 65 -def test_agents_entry_points_to_current_product_and_governance_sources() -> None: - agents = read_repo_text("AGENTS.md") - - assert "" in agents - assert "docs/architecture/naruon-product-spec.md" in agents - assert "docs/product-technical-gap-baseline.md" in agents - assert "ContextualWisdomLab/projects/1" in agents - assert "ContextualWisdomLab/naruon/issues/1428" in agents - assert "ContextualWisdomLab/naruon/pull/1436" in agents - assert "docs/agent-github-project-protocol.md" in agents - assert "docs/product-goal-directive.md" in agents - assert "not private agent memory" in agents - - def test_review_automation_uses_central_required_workflows_without_local_copies() -> ( None ): diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml index 58377eb5f..cea165615 100644 --- a/frontend/pnpm-lock.yaml +++ b/frontend/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: brace-expansion: 5.0.9 js-yaml: 4.3.2 + nanoid: 3.3.19 postcss: 8.5.24 sharp: 0.35.4 undici: 8.9.0 @@ -2254,8 +2255,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - nanoid@3.3.18: - resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} + nanoid@3.3.19: + resolution: {integrity: sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -5070,7 +5071,7 @@ snapshots: ms@2.1.3: {} - nanoid@3.3.18: {} + nanoid@3.3.19: {} napi-postinstall@0.3.4: {} @@ -5213,7 +5214,7 @@ snapshots: postcss@8.5.24: dependencies: - nanoid: 3.3.18 + nanoid: 3.3.19 picocolors: 1.1.1 source-map-js: 1.2.1 diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml index 70f2c4eea..585527fe9 100644 --- a/frontend/pnpm-workspace.yaml +++ b/frontend/pnpm-workspace.yaml @@ -16,6 +16,7 @@ supportedArchitectures: overrides: brace-expansion: "5.0.9" js-yaml: "4.3.2" + nanoid: "3.3.19" postcss: "8.5.24" sharp: "0.35.4" undici: 8.9.0