osv gate fails on main's lockfile: 3 High advisories (nanoid, js-yaml, undici) block every PR

[lukaso-bot]

scripts/osv-check.sh gates High/Critical on every PR. It is now failing on
main's existing lockfile — no code change required, the advisories were just
published — so every open PR's osv dependency scan job fails, not one of them.

✗ osv: 0 Critical + 3 High vulnerability(ies) — must be resolved before merge.

The three High findings are all transitive:

Package	In lockfile	Fixed in	Advisory	CVSS
nanoid	3.3.16	3.3.18	GHSA-2v37-7h3g-55p8	8.2
js-yaml	4.3.0	4.3.1	GHSA-5p4m-2wfm-xmqj	7.5
undici	7.28.0	7.29.0	GHSA-4cwx-7wf7-3272	7.4

The remaining 8 are Medium/Low and do not gate: 4 in hono 4.12.32 (fixed in
4.12.34) plus 4 more in undici.

Dependabot #142 does not clear this

#142 bumps hono 4.12.32 → 4.13.1, which covers the four Medium/Low hono
advisories. It does not touch nanoid, js-yaml, or undici — none of them are
direct dependencies — so the gate stays red after it merges.

Suggested fix

pnpm.overrides in the root package.json, matching the existing precedent from
9b6080a (fix(deps): pin jsdom's transitive undici to 7.x so jsdom 29 collects):

"pnpm": {
  "overrides": {
    "nanoid": "^3.3.18",
    "js-yaml": "^4.3.1",
    "undici": "^7.29.0"
  }
}

Then pnpm install, confirm scripts/osv-check.sh reports 0 High/Critical, and
run pnpm -r test — the existing undici pin exists because jsdom 29 needs 7.x,
so that constraint has to keep holding.

Note the local validate.sh run is warn-only for osv (|| true), so this does
not block committing locally — only CI, and only at the merge gate.

Found by the maintenance loop while landing #144.

[lukaso-bot]

Status: main is still red, and the queue order matters

main's lockfile carries all three Highs (nanoid 3.3.16, js-yaml 4.3.0,
undici 7.28.0), so osv dependency scan fails on every PR branched from it.
That is #144's only red check — nothing in its diff.

Merge #146 first

I re-ran #146's osv dependency scan today against current OSV data (run
32042599233, job re-run 2026-08-20): pass.
Its Aug-17 green was not stale. It is based on 39a72d0 — exactly current
origin/main, 0 commits behind — is MERGEABLE / CLEAN, and it is the only PR
whose purpose is this gate. Merging it clears all three Highs on main, and
every other PR then inherits the floors on rebase.

Where each open PR actually stands

Checked the resolved nanoid version in each branch's lockfile, not the check badge:

PR	nanoid in lockfile	osv check last ran	state
#146	3.3.18 (floor ^3.3.18)	re-verified today	✅ the unblocker
#142	3.3.18	2026-08-15	✅ clean
#141	3.3.18 (floor ^3.3.17)	2026-08-12	✅ clean, floor is looser than #146's
#138	3.3.17 → 3.3.18	2026-08-12	⚠️ was stale-green, fixed this cycle
#139	3.3.17 → 3.3.18	2026-08-12	⚠️ was stale-green, fixed this cycle
#144	3.3.16 (main's)	red now	blocked — clears on rebase after #146

The trap that was in the queue

#138 and #139 both showed a green osv badge from 2026-08-12 while their
lockfiles resolved nanoid to 3.3.17. GHSA-2v37-7h3g-55p8 (CVSS 8.2, High)
was published against nanoid < 3.3.18 after those checks ran. Merging either
would have put a High back on main and re-red this gate — this issue,
reopening itself.

Confirmed against api.osv.dev rather than inferred from the scanner table:
nanoid@3.3.17 → 1 advisory, GHSA-2v37-7h3g-55p8, HIGH; nanoid@3.3.18 → 0.

Both branches now carry the nanoid@3: ^3.3.18 floor (0ec52be, 6357601),
gate green locally, and the pre-push hook's own osv run reports
✓ osv: no High/Critical vulnerabilities. CI is re-running on both.

After #146 merges

All five remaining PRs touch the same pnpm.overrides block, so they will
conflict and need a rebase — that is why every one of them currently reports
"cannot be rebased". Expect to rebase or let Dependabot regenerate #138/#139/#142.
When #141 rebases, take main's nanoid@3: ^3.3.18 over its ^3.3.17.

Not gated, tracked separately: hono 4.12.32 → 4.12.34 carries four Mediums.
scripts/osv-check.sh gates High/Critical only, so these do not block anything;
Dependabot will bump them.

[lukaso-bot]

Fixed — main's osv gate is green

#138 merged at 1a717ce carrying the override floors, so main now pins:

package	was	now	advisory
nanoid@3	3.3.16	3.3.18	GHSA-2v37-7h3g-55p8 (High, 8.2)
js-yaml@4	4.3.0	4.3.1	High
undici	>=7.28.0	>=7.29.0	High

main's osv dependency scan job passed in CI run 32395419314
(2026-08-20T17:02Z) — verified against the job list, not inferred from a rollup.

#146 (the standalone floors PR) is now redundant and has been closed; merging it
would have reverted #138's @cloudflare/workers-types v5 bump.

The remaining lockfile PRs (#139, #141, #142) conflict on this same overrides
hunk and are being rebased onto the new main.