From 1fe7c1c1ed067e7cc469aa17d2f2f2e9cfd5ae5c Mon Sep 17 00:00:00 2001 From: VibhavSetlur Date: Wed, 26 Aug 2026 10:02:50 -0500 Subject: [PATCH 1/3] fix(deps): bump nanoid to 3.3.18 to clear GHSA-2v37-7h3g-55p8 --- CHANGELOG.md | 14 ++++++++++++++ VERSION.md | 2 +- package-lock.json | 6 +++--- package.json | 2 +- 4 files changed, 19 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 60d0f1ff..6fb701b8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 --- +## [3.1.1] - 2026-08-26 + +### Fixed +- Production `npm audit` high-severity finding resolved: `nanoid` bumped to + **3.3.18** to close GHSA-2v37-7h3g-55p8, restoring a green nightly CI audit + on the staging line + +### Changed +- Dependabot now groups routine minor and patch npm updates into one production + and one development pull request per week instead of one pull request per + package; security updates are unaffected and continue to open individually + +--- + ## [3.1.0] - 2026-08-04 ### Added diff --git a/VERSION.md b/VERSION.md index fd2a0186..94ff29cc 100644 --- a/VERSION.md +++ b/VERSION.md @@ -1 +1 @@ -3.1.0 +3.1.1 diff --git a/package-lock.json b/package-lock.json index b2e47da6..6708964c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7671,9 +7671,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.17", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", - "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 9db3604f..950e2e14 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "modelseed-ui", - "version": "3.1.0", + "version": "3.1.1", "private": true, "scripts": { "predev": "node scripts/sync-version-from-env.mjs", From ca03aaf247d43068865bbd949f014a5e68294a3b Mon Sep 17 00:00:00 2001 From: VibhavSetlur Date: Wed, 26 Aug 2026 10:02:50 -0500 Subject: [PATCH 2/3] chore(deps): group Dependabot version updates to cut PR noise --- .github/dependabot.yml | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bfb2ad73..97080832 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,8 +3,23 @@ updates: - package-ecosystem: "npm" directory: "/" schedule: - interval: "daily" - open-pull-requests-limit: 10 + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 labels: - "dependencies" - "security" + # Routine version updates are batched into two pull requests. Dependabot + # security updates are generated independently of these groups and are NOT + # suppressed by grouping - they continue to open individually and promptly. + groups: + production-dependencies: + dependency-type: "production" + update-types: + - "minor" + - "patch" + development-dependencies: + dependency-type: "development" + update-types: + - "minor" + - "patch" From 92815c44bfd49ec4bb53f5c9f64016a410d4a770 Mon Sep 17 00:00:00 2001 From: VibhavSetlur Date: Wed, 26 Aug 2026 10:07:38 -0500 Subject: [PATCH 3/3] fix(release): sync package-lock version fields to 3.1.1 --- package-lock.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 6708964c..3281a08c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "modelseed-ui", - "version": "3.1.0", + "version": "3.1.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "modelseed-ui", - "version": "3.1.0", + "version": "3.1.1", "dependencies": { "@emotion/cache": "^11.14.0", "@emotion/react": "^11.14.0",