chore: upgrade nanoid to ^3.3.18 to address CVE-2026-67213

[claude]

Fixes SOU-1891

Refreshes the yarn.lock entry for nanoid from 3.3.16 to 3.3.18, clearing CVE-2026-67213 (infinite loop in customAlphabet/customRandom when called with a size of 0). The advisory's patched floor on the 3.x line is 3.3.17.

nanoid is transitive, reached only via postcss (^3.3.16). That existing range already admits the patched release, so this is a lockfile refresh only. No manifest change and no resolutions override are needed.

Verification

• yarn why nanoid reports a single instance, nanoid@npm:3.3.18, with no affected version remaining in the graph.
• yarn install completes with no further lockfile churn.
• yarn workspace @sourcebot/web test --run: 101 files, 1191 tests passed.

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only transitive dependency bump with no application code or manifest changes; low blast radius aside from routine supply-chain patch risk.

Overview
Security lockfile refresh bumps transitive nanoid from 3.3.16 to 3.3.18 in yarn.lock, addressing CVE-2026-67213 (infinite loop in customAlphabet / customRandom when size is 0).

No package.json or Yarn resolutions changes—the existing postcss range already allows 3.3.18, so this is resolved dependency pinning only. CHANGELOG records the upgrade under Unreleased → Fixed.

^{Reviewed by Cursor Bugbot for commit 8090fec. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2196
Resolved (non-standard)	8
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (8)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo (livebook-dev/codemirror-lang-elixir LICENSE, detected Apache-2.0)
khroma	2.1.0	UNKNOWN	MIT	GitHub repo (fabiospampinato/khroma license file, detected MIT)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo (livebook-dev/lezer-elixir LICENSE, detected Apache-2.0)
map-stream	0.1.0	UNKNOWN	MIT	GitHub repo (dominictarr/map-stream LICENCE, detected MIT)
memorystream	0.3.1	UNKNOWN	MIT	extracted from object (npm registry legacy "licenses": [{"type":"MIT"}]); corroborated by GitHub repo LICENSE
pause-stream	0.0.11	MIT,Apache2	MIT OR Apache-2.0	extracted from object (npm "license": ["MIT","Apache2"]); GitHub repo LICENSE confirms "Dual Licensed MIT and Apache 2"
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	published npm tarball LICENSE (posthog-js-1.369.0.tgz) + GitHub repo, Apache License 2.0
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo (ogt/valid-url LICENSE, verbatim MIT text)