fix: bump nanoid to 3.3.18 to resolve GHSA-2v37-7h3g-55p8 (DEVX-8510)

[warp-agent-staging]

Summary

Bumps the transitive nanoid dependency from 3.3.17 to 3.3.18 to resolve GHSA-2v37-7h3g-55p8 (DEVX-8510), a high-severity DoS via infinite loop in customAlphabet/customRandom when called with size: 0.

nanoid is not a direct dependency here — it's required by postcss as ^3.3.16. However, package.json had an explicit npm overrides entry pinning nanoid to the vulnerable 3.3.17. That pin, not postcss's range, is what held the resolved tree at 3.3.17, so a plain npm update nanoid / npm audit fix could not move it without changing package.json.

The advisory has two affected ranges/patched versions: < 3.3.18 (patched at 3.3.18) and >= 4.0.0, < 5.1.6 (patched at 5.1.6). Since this repo is on the 3.x line via postcss, 3.3.18 is the correct, minimal patch — there is no need to jump to 5.1.6+, which would be a bigger migration for no additional benefit here.

Changes

• package.json: bump the overrides.nanoid pin from 3.3.17 to 3.3.18 (exact pin, matching the style of the other entries in this overrides block).
• package-lock.json: regenerated the single node_modules/nanoid entry (version, resolved, integrity) to 3.3.18 via npm, using npm's own computed values (no hand-written hashes).

nanoid remains transitive/override-only; it was not added to dependencies or devDependencies, and no other packages were touched.

Verification

• git diff — confirmed the diff touches only the nanoid override line in package.json and the single nanoid entry in package-lock.json.
• npm ci — succeeds cleanly with the regenerated lockfile.
• npm ls nanoid — resolves to nanoid@3.3.18 overridden (previously 3.3.17).
• npm audit — the nanoid/GHSA-2v37-7h3g-55p8 finding is gone. Two unrelated pre-existing advisories remain (@hono/node-server path traversal, fast-uri host confusion) — out of scope for this change.
• npm run lint — passes (0 errors; 6 pre-existing warnings unrelated to this change).
• npx prisma generate && npx next build — production build succeeds.
• Skipped: no automated test suite was run against a live database/auth provider, since that requires credentials not available here; the tests directory was reviewed but exercising it needs those secrets.

Co-Authored-By: Warp agent@warp.dev