fix(deps): add nanoid override ^3.3.17 (GHSA-2v37-7h3g-55p8)

[GeiserX]

Closes Dependabot alert #92 (high): GHSA-2v37-7h3g-55p8 — nanoid custom generators can loop indefinitely when size is zero. Vulnerable < 3.3.17, patched 3.3.17.

nanoid is transitive (runtime) via postcss (nanoid@^3.3.16) and had no override, so it sat at 3.3.16. Adds an override pinning ^3.3.17 — resolves to 3.3.18.

Staying on 3.x is deliberate: postcss declares ^3.3.16, and nanoid 4.x+ is ESM-only and outside that range.

Scope: 1 line in package.json, 3 in the lockfile (version/resolved/integrity), regenerated with npm install --package-lock-only --ignore-scripts — no unrelated churn. Integrity matches the registry's published hash.

Summary by CodeRabbit

• Chores
  • Updated package configuration to use a newer Nano ID version for improved compatibility and stability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d2e057d-2284-4738-9218-86e6a148f59e

📥 Commits

Reviewing files that changed from the base of the PR and between 17d7a67 and d86348c.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The package override configuration now pins nanoid to version ^3.3.17.

Changes

Package Configuration

Layer / File(s)	Summary
Nanoid package override package.json	Adds the nanoid package override at version ^3.3.17.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The linked issue requires setup-node in auto-tag.yml, but the PR only changes the nanoid override in package.json.	Add actions/setup-node@v4 with Node.js 22 to auto-tag.yml, or link this PR to the dependency security issue.
Out of Scope Changes check	⚠️ Warning	The nanoid dependency override is unrelated to the linked issue about adding setup-node to the auto-tag workflow.	Move the nanoid security update to a separate PR or update the linked issue to cover the dependency change.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the nanoid dependency override and its security advisory.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nanoid-ghsa-2v37

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}