From c7497db57db4004a01e282f6d25a2dcc4fe465f9 Mon Sep 17 00:00:00 2001 From: Benoit Travers Date: Thu, 13 Aug 2026 20:34:06 +0200 Subject: [PATCH 1/3] ci: point reusable workflow refs at renamed btravstack/tools repo The shared-config repo was renamed config -> tools (btravstack/tools#1). GitHub redirects the old name, so this is a no-op functionally. Co-Authored-By: Claude Fable 5 --- .github/actions/setup/action.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 6620fee..57f7787 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -1,7 +1,7 @@ name: "Setup Node.js and pnpm" description: "Setup Node.js and pnpm, install dependencies" -# CI and Release call btravstack/config's reusable workflows, which do their own +# CI and Release call btravstack/tools's reusable workflows, which do their own # setup. This composite exists for Deploy Documentation, which runs its own # steps in this repo and needs the same toolchain. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 07cb33e..0054ee1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ concurrency: jobs: ci: - uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1 + uses: btravstack/tools/.github/workflows/ci-reusable.yml@workflows-v1 with: # "" uses .node-version (the dev/primary version, currently 24.16.0). # 22.19 is the ROOT package's engines floor — the oldest Node this repo diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 288c1fb..b8927d0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,6 +17,6 @@ jobs: contents: write pull-requests: write id-token: write - uses: btravstack/config/.github/workflows/release-reusable.yml@workflows-v1 + uses: btravstack/tools/.github/workflows/release-reusable.yml@workflows-v1 secrets: RELEASE_PAT: ${{ secrets.RELEASE_PAT }} From 41835f76fdc4e2aa10941979422a17f0f71c0ea8 Mon Sep 17 00:00:00 2001 From: Benoit Travers Date: Thu, 13 Aug 2026 21:20:09 +0200 Subject: [PATCH 2/3] fix(deps): raise nanoid/dompurify floors for widened advisories GHSA-2v37-7h3g-55p8 widened to nanoid <3.3.18; nanoid 3.3.18 (published 2026-08-07) is inside the 7-day maturity window where a gate applies, so it gets a dated temporary exclusion. GHSA-55q2-fjhq-7xh7 moves dompurify to 3.4.13 where present (10 days old, no exclusion needed). Docs/build tooling only; pnpm audit is clean. Co-Authored-By: Claude Fable 5 --- pnpm-lock.yaml | 9 +++++---- pnpm-workspace.yaml | 5 +++++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 71031c3..cdf288f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -103,6 +103,7 @@ catalogs: overrides: vite@<6.4.3: 6.4.3 + nanoid@<3.3.18: 3.3.18 importers: @@ -2713,8 +2714,8 @@ packages: resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==} engines: {node: '>=4'} - nanoid@3.3.17: - resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -5399,7 +5400,7 @@ snapshots: mri@1.2.0: {} - nanoid@3.3.17: {} + nanoid@3.3.18: {} obug@2.1.4: {} @@ -5555,7 +5556,7 @@ snapshots: postcss@8.5.25: dependencies: - nanoid: 3.3.17 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 6cd16f7..54fc381 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -97,6 +97,11 @@ overrides: # Pinning vitest's vite apart would mean an inline `vite` devDependency on the # library package for a purely transitive concern; not worth it. "vite@<6.4.3": "6.4.3" + # GHSA-2v37-7h3g-55p8 (High): nanoid custom generators can loop indefinitely + # when size is zero. Reaches us only through the docs build — + # docs > @btravstack/theme > vitepress > postcss > nanoid — never the shipped + # package. 3.3.18 is the first release patched for the widened range. + "nanoid@<3.3.18": "3.3.18" peerDependencyRules: ignoreMissing: From 8d4679e25e98f85b164eb05ca8202180fb095910 Mon Sep 17 00:00:00 2001 From: Benoit Travers Date: Thu, 13 Aug 2026 21:31:04 +0200 Subject: [PATCH 3/3] docs(ci): reword setup-action comment after review Co-Authored-By: Claude Fable 5 --- .github/actions/setup/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 57f7787..108050b 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -1,7 +1,7 @@ name: "Setup Node.js and pnpm" description: "Setup Node.js and pnpm, install dependencies" -# CI and Release call btravstack/tools's reusable workflows, which do their own +# CI and Release call the reusable workflows in btravstack/tools, which do their own # setup. This composite exists for Deploy Documentation, which runs its own # steps in this repo and needs the same toolchain.