From 38b5888f25451be30e0f10cb2bd619a687e4dd5b Mon Sep 17 00:00:00 2001
From: Parv Ahuja <17094219+parvahuja@users.noreply.github.com>
Date: Mon, 17 Aug 2026 17:16:57 -0400
Subject: [PATCH 1/5] docs: add funded account onboarding
---
site/src/pages/docs/cli/provider.mdx | 9 +++
site/src/pages/docs/guides/deposits.mdx | 60 +++++++++++++++++++
.../docs/rpc/wallet_authorizeAccessKey.mdx | 4 +-
site/src/pages/docs/rpc/wallet_connect.mdx | 2 +-
src/cli/Provider.localnet.test.ts | 12 ++--
src/core/zod/rpc.test.ts | 52 ++++++++++++++++
src/core/zod/rpc.ts | 7 ++-
7 files changed, 134 insertions(+), 12 deletions(-)
diff --git a/site/src/pages/docs/cli/provider.mdx b/site/src/pages/docs/cli/provider.mdx
index a1c9b739..bba8e6b6 100644
--- a/site/src/pages/docs/cli/provider.mdx
+++ b/site/src/pages/docs/cli/provider.mdx
@@ -50,10 +50,19 @@ await connect(client, { // [!code focus]
selector: 'transfer(address,uint256)', // [!code focus]
}], // [!code focus]
}, // [!code focus]
+ showDeposit: { // [!code focus]
+ amount: '10', // [!code focus]
+ displayName: 'My CLI', // [!code focus]
+ token: 'MACHUSD', // [!code focus]
+ }, // [!code focus]
}, // [!code focus]
}) // [!code focus]
```
+`showDeposit` belongs beside `authorizeAccessKey`, not inside it. The browser
+approval carries the same funding request used by web integrations, while the
+authorized key remains available to the CLI after the browser closes.
+
## Parameters
### auth
diff --git a/site/src/pages/docs/guides/deposits.mdx b/site/src/pages/docs/guides/deposits.mdx
index 4e2a92b3..fdab761f 100644
--- a/site/src/pages/docs/guides/deposits.mdx
+++ b/site/src/pages/docs/guides/deposits.mdx
@@ -169,6 +169,66 @@ connect.connect({
:::
+When `amount` and `token` are provided, the wallet treats the amount as the
+desired minimum balance for that token. It skips the prompt when the connected
+account already has enough and asks for only the remaining amount when it is
+partially funded.
+
+### Authorize and Fund in One Flow
+
+Keep access-key authorization and funding as sibling capabilities on
+`wallet_connect`. This lets browser and CLI consumers use the same account
+creation, authorization, and funding ceremony.
+
+```tsx twoslash [Connect.tsx]
+// @noErrors
+import { Expiry } from 'accounts'
+import { parseUnits } from 'viem'
+import { useConnect, useConnectors } from 'wagmi'
+
+declare const machineUsd: `0x${string}`
+
+export function ConnectFunded() {
+ const connect = useConnect()
+ const [connector] = useConnectors()
+
+ return (
+
+ )
+}
+```
+
+The funding prompt remains optional. A successful connection means the account
+and requested access key are ready; if the user skips funding, check the token
+balance before an action that requires funds and call `wallet_deposit` again
+when needed.
+
## Next Steps
diff --git a/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx b/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx
index 99e3f6a7..9c0c13fa 100644
--- a/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx
+++ b/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx
@@ -50,7 +50,7 @@ type Request = {
}
type ShowDeposit = boolean | {
- /** Human-readable amount to pre-fill (e.g. `"50"`). */
+ /** Human-readable minimum token balance to request (e.g. `"50"`). */
amount?: string
/** Display name shown in the deposit UI. */
displayName?: string
@@ -61,7 +61,7 @@ type ShowDeposit = boolean | {
Tempo Wallet-hosted approval pages require at least one `limits` entry and one `scopes` entry. Use the `address` field on each scope for the target contract; malformed scope entries are rejected before approval.
-Set `showDeposit` to `true` or funding hints to show the optional deposit picker before the wallet returns the authorization result.
+Set `showDeposit` to `true` or provide a desired token balance to show the optional deposit picker before the wallet returns the authorization result. The wallet may skip the picker when the account already meets the requested balance.
## Response
diff --git a/site/src/pages/docs/rpc/wallet_connect.mdx b/site/src/pages/docs/rpc/wallet_connect.mdx
index fa5c7ecc..c6012ee3 100644
--- a/site/src/pages/docs/rpc/wallet_connect.mdx
+++ b/site/src/pages/docs/rpc/wallet_connect.mdx
@@ -92,7 +92,7 @@ type Identity = {
}
type ShowDeposit = boolean | {
- /** Human-readable amount to pre-fill (e.g. `"50"`). */
+ /** Human-readable minimum token balance to request (e.g. `"50"`). */
amount?: string
/** Display name shown in the deposit UI (e.g. the app name). */
displayName?: string
diff --git a/src/cli/Provider.localnet.test.ts b/src/cli/Provider.localnet.test.ts
index c17e1be3..0cf61dd1 100644
--- a/src/cli/Provider.localnet.test.ts
+++ b/src/cli/Provider.localnet.test.ts
@@ -305,10 +305,10 @@ describe('Provider.create', () => {
connectRequest({
method: 'register',
showDeposit: {
- amount: '50',
- displayName: 'DoorDash',
+ amount: '10',
+ displayName: 'Funded CLI',
on: 'register',
- token: 'USDC',
+ token: 'MACHUSD',
},
}),
)
@@ -316,10 +316,10 @@ describe('Provider.create', () => {
expect(pendingShowDeposit).toMatchInlineSnapshot(`
[
{
- "amount": "50",
- "displayName": "DoorDash",
+ "amount": "10",
+ "displayName": "Funded CLI",
"on": "register",
- "token": "USDC",
+ "token": "MACHUSD",
},
]
`)
diff --git a/src/core/zod/rpc.test.ts b/src/core/zod/rpc.test.ts
index 265d1407..e810b78c 100644
--- a/src/core/zod/rpc.test.ts
+++ b/src/core/zod/rpc.test.ts
@@ -598,6 +598,58 @@ describe('wallet_connect.capabilities.result: identity', () => {
})
describe('wallet_connect.capabilities.request: showDeposit', () => {
+ test('accepts funded access-key onboarding as sibling capabilities', () => {
+ expect(
+ z.parse(Rpc.wallet_connect.capabilities.request, {
+ authorizeAccessKey: {
+ expiry: 123,
+ limits: [
+ {
+ limit: 10_000_000n,
+ token: '0x20c0000000000000000000000000000000000001',
+ },
+ ],
+ scopes: [
+ {
+ address: '0x20c0000000000000000000000000000000000001',
+ selector: 'transfer(address,uint256)',
+ },
+ ],
+ },
+ method: 'login',
+ showDeposit: {
+ amount: '10',
+ displayName: 'Example app',
+ token: 'MACHUSD',
+ },
+ }),
+ ).toMatchInlineSnapshot(`
+ {
+ "authorizeAccessKey": {
+ "expiry": 123,
+ "limits": [
+ {
+ "limit": 10000000n,
+ "token": "0x20c0000000000000000000000000000000000001",
+ },
+ ],
+ "scopes": [
+ {
+ "address": "0x20c0000000000000000000000000000000000001",
+ "selector": "transfer(address,uint256)",
+ },
+ ],
+ },
+ "method": "login",
+ "showDeposit": {
+ "amount": "10",
+ "displayName": "Example app",
+ "token": "MACHUSD",
+ },
+ }
+ `)
+ })
+
test('accepts true on the register branch', () => {
expect(
z.parse(Rpc.wallet_connect.capabilities.request, {
diff --git a/src/core/zod/rpc.ts b/src/core/zod/rpc.ts
index 7d9ca7a8..87a87b5e 100644
--- a/src/core/zod/rpc.ts
+++ b/src/core/zod/rpc.ts
@@ -452,13 +452,14 @@ export namespace wallet_authorizeAccessKey {
* Shows an optional funding prompt after `wallet_authorizeAccessKey`
* succeeds.
*
- * `true` prompts after approval. Object form pre-fills deposit UI hints.
+ * `true` prompts after approval. Object form supplies a desired balance and
+ * deposit UI hints.
*/
export const showDeposit = z.optional(
z.union([
z.boolean(),
z.object({
- /** Human-readable amount to pre-fill (e.g. `"50"`). */
+ /** Human-readable minimum token balance to request (e.g. `"50"`). */
amount: z.optional(z.string()),
/** Display name shown in the deposit UI (e.g. the app name). */
displayName: z.optional(z.string()),
@@ -583,7 +584,7 @@ export namespace wallet_connect {
z.union([
z.boolean(),
z.object({
- /** Human-readable amount to pre-fill (e.g. `"50"`). */
+ /** Human-readable minimum token balance to request (e.g. `"50"`). */
amount: z.optional(z.string()),
/** Display name shown in the deposit UI (e.g. the app name). */
displayName: z.optional(z.string()),
From 77f7397ca48ff080e0afa4cda84a87e8291b470f Mon Sep 17 00:00:00 2001
From: Parv Ahuja <17094219+parvahuja@users.noreply.github.com>
Date: Mon, 17 Aug 2026 18:59:57 -0400
Subject: [PATCH 2/5] docs: simplify MACHUSD deposit guidance
---
site/src/pages/docs/cli/provider.mdx | 4 --
site/src/pages/docs/guides/deposits.mdx | 61 +------------------
.../docs/rpc/wallet_authorizeAccessKey.mdx | 4 +-
site/src/pages/docs/rpc/wallet_connect.mdx | 2 +-
src/cli/Provider.localnet.test.ts | 12 ++--
src/core/zod/rpc.test.ts | 52 ----------------
src/core/zod/rpc.ts | 7 +--
7 files changed, 14 insertions(+), 128 deletions(-)
diff --git a/site/src/pages/docs/cli/provider.mdx b/site/src/pages/docs/cli/provider.mdx
index bba8e6b6..fe73c35a 100644
--- a/site/src/pages/docs/cli/provider.mdx
+++ b/site/src/pages/docs/cli/provider.mdx
@@ -59,10 +59,6 @@ await connect(client, { // [!code focus]
}) // [!code focus]
```
-`showDeposit` belongs beside `authorizeAccessKey`, not inside it. The browser
-approval carries the same funding request used by web integrations, while the
-authorized key remains available to the CLI after the browser closes.
-
## Parameters
### auth
diff --git a/site/src/pages/docs/guides/deposits.mdx b/site/src/pages/docs/guides/deposits.mdx
index fdab761f..7f0e1975 100644
--- a/site/src/pages/docs/guides/deposits.mdx
+++ b/site/src/pages/docs/guides/deposits.mdx
@@ -169,65 +169,8 @@ connect.connect({
:::
-When `amount` and `token` are provided, the wallet treats the amount as the
-desired minimum balance for that token. It skips the prompt when the connected
-account already has enough and asks for only the remaining amount when it is
-partially funded.
-
-### Authorize and Fund in One Flow
-
-Keep access-key authorization and funding as sibling capabilities on
-`wallet_connect`. This lets browser and CLI consumers use the same account
-creation, authorization, and funding ceremony.
-
-```tsx twoslash [Connect.tsx]
-// @noErrors
-import { Expiry } from 'accounts'
-import { parseUnits } from 'viem'
-import { useConnect, useConnectors } from 'wagmi'
-
-declare const machineUsd: `0x${string}`
-
-export function ConnectFunded() {
- const connect = useConnect()
- const [connector] = useConnectors()
-
- return (
-
- )
-}
-```
-
-The funding prompt remains optional. A successful connection means the account
-and requested access key are ready; if the user skips funding, check the token
-balance before an action that requires funds and call `wallet_deposit` again
-when needed.
+Use `token: 'MACHUSD'` the same way as `pathUSD` or `USDC.e`. Accounts forwards
+the token symbol to the wallet, which selects the matching deposit flow.
## Next Steps
diff --git a/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx b/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx
index 9c0c13fa..99e3f6a7 100644
--- a/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx
+++ b/site/src/pages/docs/rpc/wallet_authorizeAccessKey.mdx
@@ -50,7 +50,7 @@ type Request = {
}
type ShowDeposit = boolean | {
- /** Human-readable minimum token balance to request (e.g. `"50"`). */
+ /** Human-readable amount to pre-fill (e.g. `"50"`). */
amount?: string
/** Display name shown in the deposit UI. */
displayName?: string
@@ -61,7 +61,7 @@ type ShowDeposit = boolean | {
Tempo Wallet-hosted approval pages require at least one `limits` entry and one `scopes` entry. Use the `address` field on each scope for the target contract; malformed scope entries are rejected before approval.
-Set `showDeposit` to `true` or provide a desired token balance to show the optional deposit picker before the wallet returns the authorization result. The wallet may skip the picker when the account already meets the requested balance.
+Set `showDeposit` to `true` or funding hints to show the optional deposit picker before the wallet returns the authorization result.
## Response
diff --git a/site/src/pages/docs/rpc/wallet_connect.mdx b/site/src/pages/docs/rpc/wallet_connect.mdx
index c6012ee3..fa5c7ecc 100644
--- a/site/src/pages/docs/rpc/wallet_connect.mdx
+++ b/site/src/pages/docs/rpc/wallet_connect.mdx
@@ -92,7 +92,7 @@ type Identity = {
}
type ShowDeposit = boolean | {
- /** Human-readable minimum token balance to request (e.g. `"50"`). */
+ /** Human-readable amount to pre-fill (e.g. `"50"`). */
amount?: string
/** Display name shown in the deposit UI (e.g. the app name). */
displayName?: string
diff --git a/src/cli/Provider.localnet.test.ts b/src/cli/Provider.localnet.test.ts
index 0cf61dd1..c17e1be3 100644
--- a/src/cli/Provider.localnet.test.ts
+++ b/src/cli/Provider.localnet.test.ts
@@ -305,10 +305,10 @@ describe('Provider.create', () => {
connectRequest({
method: 'register',
showDeposit: {
- amount: '10',
- displayName: 'Funded CLI',
+ amount: '50',
+ displayName: 'DoorDash',
on: 'register',
- token: 'MACHUSD',
+ token: 'USDC',
},
}),
)
@@ -316,10 +316,10 @@ describe('Provider.create', () => {
expect(pendingShowDeposit).toMatchInlineSnapshot(`
[
{
- "amount": "10",
- "displayName": "Funded CLI",
+ "amount": "50",
+ "displayName": "DoorDash",
"on": "register",
- "token": "MACHUSD",
+ "token": "USDC",
},
]
`)
diff --git a/src/core/zod/rpc.test.ts b/src/core/zod/rpc.test.ts
index e810b78c..265d1407 100644
--- a/src/core/zod/rpc.test.ts
+++ b/src/core/zod/rpc.test.ts
@@ -598,58 +598,6 @@ describe('wallet_connect.capabilities.result: identity', () => {
})
describe('wallet_connect.capabilities.request: showDeposit', () => {
- test('accepts funded access-key onboarding as sibling capabilities', () => {
- expect(
- z.parse(Rpc.wallet_connect.capabilities.request, {
- authorizeAccessKey: {
- expiry: 123,
- limits: [
- {
- limit: 10_000_000n,
- token: '0x20c0000000000000000000000000000000000001',
- },
- ],
- scopes: [
- {
- address: '0x20c0000000000000000000000000000000000001',
- selector: 'transfer(address,uint256)',
- },
- ],
- },
- method: 'login',
- showDeposit: {
- amount: '10',
- displayName: 'Example app',
- token: 'MACHUSD',
- },
- }),
- ).toMatchInlineSnapshot(`
- {
- "authorizeAccessKey": {
- "expiry": 123,
- "limits": [
- {
- "limit": 10000000n,
- "token": "0x20c0000000000000000000000000000000000001",
- },
- ],
- "scopes": [
- {
- "address": "0x20c0000000000000000000000000000000000001",
- "selector": "transfer(address,uint256)",
- },
- ],
- },
- "method": "login",
- "showDeposit": {
- "amount": "10",
- "displayName": "Example app",
- "token": "MACHUSD",
- },
- }
- `)
- })
-
test('accepts true on the register branch', () => {
expect(
z.parse(Rpc.wallet_connect.capabilities.request, {
diff --git a/src/core/zod/rpc.ts b/src/core/zod/rpc.ts
index 87a87b5e..7d9ca7a8 100644
--- a/src/core/zod/rpc.ts
+++ b/src/core/zod/rpc.ts
@@ -452,14 +452,13 @@ export namespace wallet_authorizeAccessKey {
* Shows an optional funding prompt after `wallet_authorizeAccessKey`
* succeeds.
*
- * `true` prompts after approval. Object form supplies a desired balance and
- * deposit UI hints.
+ * `true` prompts after approval. Object form pre-fills deposit UI hints.
*/
export const showDeposit = z.optional(
z.union([
z.boolean(),
z.object({
- /** Human-readable minimum token balance to request (e.g. `"50"`). */
+ /** Human-readable amount to pre-fill (e.g. `"50"`). */
amount: z.optional(z.string()),
/** Display name shown in the deposit UI (e.g. the app name). */
displayName: z.optional(z.string()),
@@ -584,7 +583,7 @@ export namespace wallet_connect {
z.union([
z.boolean(),
z.object({
- /** Human-readable minimum token balance to request (e.g. `"50"`). */
+ /** Human-readable amount to pre-fill (e.g. `"50"`). */
amount: z.optional(z.string()),
/** Display name shown in the deposit UI (e.g. the app name). */
displayName: z.optional(z.string()),
From 3f4f7cb25046bf6b49f9c1b4c76688b6edf00cd4 Mon Sep 17 00:00:00 2001
From: Parv Ahuja <17094219+parvahuja@users.noreply.github.com>
Date: Mon, 17 Aug 2026 19:17:35 -0400
Subject: [PATCH 3/5] chore: trust Mercator wallet iframe
---
site/src/pages/docs/guides/deposits.mdx | 3 ++-
src/core/adapters/postMessage/mount.test.ts | 2 +-
src/trusted-hosts.json | 1 +
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/site/src/pages/docs/guides/deposits.mdx b/site/src/pages/docs/guides/deposits.mdx
index 7f0e1975..4747e7e5 100644
--- a/site/src/pages/docs/guides/deposits.mdx
+++ b/site/src/pages/docs/guides/deposits.mdx
@@ -170,7 +170,8 @@ connect.connect({
:::
Use `token: 'MACHUSD'` the same way as `pathUSD` or `USDC.e`. Accounts forwards
-the token symbol to the wallet, which selects the matching deposit flow.
+the token symbol through the reusable Tempo Wallet iframe, which selects the
+matching deposit flow.
## Next Steps
diff --git a/src/core/adapters/postMessage/mount.test.ts b/src/core/adapters/postMessage/mount.test.ts
index 484acbd5..07e0da71 100644
--- a/src/core/adapters/postMessage/mount.test.ts
+++ b/src/core/adapters/postMessage/mount.test.ts
@@ -36,7 +36,7 @@ describe('auto', () => {
vi.stubGlobal('window', {
isSecureContext: true,
location: {
- hostname: 'app.polyhedge.capital',
+ hostname: 'mercator.tempoxyz.dev',
protocol: 'https:',
},
})
diff --git a/src/trusted-hosts.json b/src/trusted-hosts.json
index effbc270..75c02a9c 100644
--- a/src/trusted-hosts.json
+++ b/src/trusted-hosts.json
@@ -13,6 +13,7 @@
"*.porto.workers.dev",
"benedict.dev",
"papercut.lol",
+ "mercator.tempoxyz.dev",
"tempo-docs-git-jxom-accounts-sdk-docs-tempoxyz.vercel.app",
"appkit-wagmi-tempo-wallet.vercel.app",
"tip.bot",
From 4e3e996ae31a179134a7aa5b9df231b66af866a2 Mon Sep 17 00:00:00 2001
From: Parv Ahuja <17094219+parvahuja@users.noreply.github.com>
Date: Mon, 17 Aug 2026 19:44:29 -0400
Subject: [PATCH 4/5] fix: delegate payments to wallet iframes
---
src/core/Dialog.browser.test.ts | 1 +
src/core/Dialog.ts | 2 +-
src/core/adapters/postMessage/mount.ts | 2 +-
3 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/core/Dialog.browser.test.ts b/src/core/Dialog.browser.test.ts
index 94d7d1a3..67a93aaf 100644
--- a/src/core/Dialog.browser.test.ts
+++ b/src/core/Dialog.browser.test.ts
@@ -72,6 +72,7 @@ describe('Dialog.iframe', () => {
const allow = iframe.getAttribute('allow')!
expect(allow).toContain('publickey-credentials-get')
expect(allow).toContain('publickey-credentials-create')
+ expect(allow).toContain('payment *')
})
test('behavior: iframe src points to host', () => {
diff --git a/src/core/Dialog.ts b/src/core/Dialog.ts
index 9d39aa7e..3cbf2e94 100644
--- a/src/core/Dialog.ts
+++ b/src/core/Dialog.ts
@@ -167,7 +167,7 @@ export function iframe(): Dialog {
`publickey-credentials-get ${hostUrl.origin}`,
`publickey-credentials-create ${hostUrl.origin}`,
'clipboard-write',
- 'payment',
+ 'payment *',
].join('; '),
)
frame.setAttribute('allowtransparency', 'true')
diff --git a/src/core/adapters/postMessage/mount.ts b/src/core/adapters/postMessage/mount.ts
index 663d3522..4c1d2a05 100644
--- a/src/core/adapters/postMessage/mount.ts
+++ b/src/core/adapters/postMessage/mount.ts
@@ -122,7 +122,7 @@ export function iframe(): Factory {
`publickey-credentials-get ${origin}`,
`publickey-credentials-create ${origin}`,
'clipboard-write',
- 'payment',
+ 'payment *',
].join('; '),
)
frame.setAttribute('allowtransparency', 'true')
From 017b3744d7baa73e879e94058309d07dd6b78b4d Mon Sep 17 00:00:00 2001
From: Parv Ahuja <17094219+parvahuja@users.noreply.github.com>
Date: Tue, 18 Aug 2026 01:09:05 -0400
Subject: [PATCH 5/5] fix: patch nanoid advisory
---
pnpm-lock.yaml | 10 +++++-----
pnpm-workspace.yaml | 5 +++--
2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b2a2e9b1..14c27749 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -80,7 +80,7 @@ overrides:
js-yaml@^3: 3.15.1
js-yaml@4: 4.3.1
mermaid: 11.16.1
- nanoid@<3.3.17: 3.3.17
+ nanoid@<3.3.18: 3.3.18
ox: 0.14.30
postcss: 8.5.23
protobufjs: 7.6.5
@@ -9039,8 +9039,8 @@ packages:
nan@2.24.0:
resolution: {integrity: sha512-Vpf9qnVW1RaDkoNKFUvfxqAbtI8ncb8OJlqZ9wwpXzWPEsvsB1nvdUi6oYrHIkQ1Y/tMDnr1h4nczS0VB9Xykg==}
- nanoid@3.3.17:
- resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
+ nanoid@3.3.18:
+ resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
hasBin: true
@@ -23668,7 +23668,7 @@ snapshots:
nan@2.24.0:
optional: true
- nanoid@3.3.17: {}
+ nanoid@3.3.18: {}
negotiator@0.6.3: {}
@@ -24509,7 +24509,7 @@ snapshots:
postcss@8.5.23:
dependencies:
- nanoid: 3.3.17
+ nanoid: 3.3.18
picocolors: 1.1.1
source-map-js: 1.2.1
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 3f21b0a7..67ec5bda 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -76,7 +76,7 @@ minimumReleaseAgeExclude:
- ip-address@10.3.1
- js-yaml@3.15.1
- js-yaml@4.3.1
- - nanoid@3.3.17
+ - nanoid@3.3.18
- postcss@8.5.23
- socket.io-parser@4.2.7
- undici@7.29.0
@@ -132,7 +132,8 @@ overrides:
js-yaml@^3: '3.15.1'
js-yaml@4: '4.3.1'
mermaid: '11.16.1'
- 'nanoid@<3.3.17': '3.3.17'
+ # GHSA-2v37-7h3g-55p8: custom generators can loop indefinitely when size is zero.
+ 'nanoid@<3.3.18': '3.3.18'
ox: 0.14.30
postcss: '8.5.23'
protobufjs: '7.6.5'