From 01a9823ed461de8aa62340a99c537042f7a35600 Mon Sep 17 00:00:00 2001
From: GitHub <action@github.com>
Date: Fri, 14 Aug 2026 17:30:13 +0800
Subject: [PATCH] =?UTF-8?q?fix(web):=20=E5=8D=87=E7=BA=A7=20postcss/nanoid?=
 =?UTF-8?q?=20=E4=BF=AE=E5=A4=8D=20Dependabot=20=E5=AE=89=E5=85=A8?=
 =?UTF-8?q?=E5=91=8A=E8=AD=A6=EF=BC=88alerts=20#2=20#3=20#5=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- postcss 8.5.16 -> 8.5.26：修复路径遍历读取任意 .map 文件（GHSA 高危）及后续不完整修复
- nanoid 3.3.15 -> 3.3.18：修复非安全生成器负数 size 死循环（高危）

均为 vite / @vue/compiler-sfc 的 semver 兼容间接依赖，仅更新 lockfile；
npm run build 验证通过。
---
 web-ui/package-lock.json | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/web-ui/package-lock.json b/web-ui/package-lock.json
index ce5125c..e7101a9 100644
--- a/web-ui/package-lock.json
+++ b/web-ui/package-lock.json
@@ -1052,9 +1052,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.15",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
-      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "funding": [
         {
           "type": "github",
@@ -1123,9 +1123,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.16",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
-      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -1142,7 +1142,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.17",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },