chore: upgrade nanoid to ^3.3.18 to address CVE-2026-67213

[claude]

Fixes SOU-1891

Refreshes the yarn.lock entry for nanoid from 3.3.16 to 3.3.18, clearing CVE-2026-67213 (infinite loop in customAlphabet/customRandom when called with a size of 0). The advisory's patched floor on the 3.x line is 3.3.17.

nanoid is transitive, reached only via postcss (^3.3.16). That existing range already admits the patched release, so this is a lockfile refresh only. No manifest change and no resolutions override are needed.

Verification

• yarn why nanoid reports a single instance, nanoid@npm:3.3.18, with no affected version remaining in the graph.
• yarn install completes with no further lockfile churn.
• yarn workspace @sourcebot/web test --run: 101 files, 1191 tests passed.

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only transitive dependency bump with no application code changes; minimal operational risk beyond routine supply-chain patching.

Overview
Bumps the transitive nanoid dependency from 3.3.16 to 3.3.18 via a yarn.lock refresh only—no package.json or Yarn resolutions changes. postcss already allows ^3.3.16, so the patched release is picked up without manifest edits.

Documents the upgrade under Unreleased → Fixed in CHANGELOG.md, addressing CVE-2026-67213 (potential infinite loop in customAlphabet / customRandom when size is 0).

^{Reviewed by Cursor Bugbot for commit 3271c46. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.