fix(deps): patch nanoid security advisory

[qnbs]

User description

Resolves the CI-blocking GHSA-2v37-7h3g-55p8 advisory by forcing the PostCSS transitive nanoid dependency from 3.3.17 to the fixed 3.3.18 release.\n\nValidation: lockfile diff is limited to the nanoid override/package/snapshot references; cloud OSV and full CI are required.

Summary by Sourcery

Update the nanoid v3 workspace override to the patched 3.3.18 release to address the security advisory blocking CI.

Bug Fixes:

• Resolve the PostCSS transitive nanoid vulnerability by pinning nanoid@^3 to version 3.3.18 in the workspace overrides.

Build:

• Adjust dependency overrides to enforce the patched nanoid@^3 version across the workspace and lockfile.

---

CodeAnt-AI Description

Patch the vulnerable Nano ID dependency used by PostCSS

What Changed

• Updates the Nano ID 3 dependency from 3.3.17 to the fixed 3.3.18 release
• Ensures workspace installs and the lockfile consistently resolve the patched version

Impact

✅ CI security advisory resolved
✅ Reduced vulnerability exposure in PostCSS tooling
✅ Consistent patched dependency installs

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	e1095b1	Aug 13, 2026 · 17:02	17:04

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldscript-studio	Ready	Preview	Aug 13, 2026 5:08pm

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates the pnpm workspace override to force the transitive nanoid@^3 dependency to the patched 3.3.18 release and refreshes the lockfile accordingly to resolve a CI-blocking security advisory.

File-Level Changes

Change	Details	Files
Force nanoid@^3 to the patched 3.3.18 version via pnpm overrides and refresh associated lockfile entries.	Update the nanoid@^3 override version in pnpm-workspace configuration from 3.3.17 to 3.3.18 to apply the security fix to transitive dependencies (e.g., via PostCSS). Regenerate pnpm-lock to reflect the new nanoid@^3 resolution, ensuring only nanoid-related entries (override, package, snapshot) are changed.	pnpm-workspace.yaml pnpm-lock.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[qnbs]

@CodeAnt-AI review

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 19 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2b51fa5a-e5cb-4a31-90fd-59a40831fc44

📥 Commits

Reviewing files that changed from the base of the PR and between f32c680 and 61df5ab.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}

[codeant-ai]

CodeAnt AI is running the review.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider using a bounded range for the nanoid@^3 override (e.g., ">=3.3.18 <4") rather than a single fixed version to allow future patch updates without needing manual lockstep changes.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider using a bounded range for the nanoid@^3 override (e.g., ">=3.3.18 <4") rather than a single fixed version to allow future patch updates without needing manual lockstep changes.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[qodo-code-review]

PR Summary by Qodo

Force nanoid@^3 to 3.3.18 to resolve CI-blocking GHSA advisory

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Force nanoid@^3 to 3.3.18 via pnpm workspace overrides.
• Refresh pnpm lockfile so PostCSS resolves the patched nanoid.
• Unblock CI security gate triggered by GHSA-2v37-7h3g-55p8.

Diagram

graph TD
  A["pnpm-workspace.yaml overrides"] --> B["pnpm resolver"] --> C["pnpm-lock.yaml"]
  B --> D["postcss"] --> E["nanoid 3.3.18"]
  C --> F["CI security gate"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Upgrade upstream dependency chain (e.g., PostCSS/tooling)

• ➕ Removes need for a workspace-level pin/override
• ➕ Reduces risk of version skew if multiple trees expect different ranges
• ➖ Potentially larger, riskier change with broader lockfile churn
• ➖ May not be immediately available if upstream hasn’t released yet

2. Use a narrower override scoped to the exact transitive path

• ➕ Minimizes impact to other consumers of nanoid@^3
• ➕ Reduces chance of unintended cross-workspace constraints
• ➖ More complex to maintain and may be brittle across dependency graph changes
• ➖ Still requires lockfile updates when the tree shifts

3. Temporarily allowlist/waive the advisory in CI (time-boxed)

• ➕ Fastest way to unblock CI if an override causes issues
• ➖ Leaves known vulnerable version in the graph
• ➖ Policy/process overhead and risk of waiver becoming permanent

Recommendation: Keep the current workspace override + lockfile update: it’s the smallest change that deterministically forces the patched nanoid version and unblocks CI. Consider removing the override later once upstream dependencies natively resolve to 3.3.18+.

Files changed (2) +6 / -6

Other (2) +6 / -6

pnpm-lock.yamlBump locked nanoid@3.3.17 to 3.3.18 across packages/snapshots +5/-5

Bump locked nanoid@3.3.17 to 3.3.18 across packages/snapshots

• Updates the lockfile’s override resolution entry and the nanoid package/snapshot references from 3.3.17 to 3.3.18. Ensures PostCSS’s dependency snapshot points at the patched nanoid version.

pnpm-lock.yaml

pnpm-workspace.yamlPin nanoid@^3 override to 3.3.18 +1/-1

Pin nanoid@^3 override to 3.3.18

• Updates the workspace override for nanoid@^3 from 3.3.17 to 3.3.18 to address the security advisory affecting transitive dev tooling dependencies.

pnpm-workspace.yaml

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit: 61df5abc
Scan Time: 2026-08-13 17:32:05 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating S: No issues

View Full Results

[codeant-ai]

CodeAnt AI finished running the review.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Missing QNBS annotation for override ✗ Dismissed 📘 Rule violation § Compliance

Description

The workspace dependency override changes the resolved runtime/install configuration from
nanoid@3.3.17 to 3.3.18, but the modified configuration line has no QNBS-v3 annotation in the
diff. This violates the requirement to annotate substantive configuration changes that affect
runtime behavior.

Code

pnpm-workspace.yaml[84]

+  nanoid@^3: "3.3.18"

Relevance

●●● Strong

Repo frequently requires adjacent QNBS-v3 why-comments for substantive changes; missing annotation
is usually fixed.

PR-#284
PR-#345
PR-#297

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed workspace override is substantive configuration affecting dependency resolution, while
the diff contains no QNBS-v3 annotation immediately above it. The existing QNBS-v3 comment is above
a later adm-zip entry and does not annotate the nanoid change.

Rule 2524933: Require QNBS-v3 annotation comments on all non-trivial code changes
pnpm-workspace.yaml[84-86]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The modified `nanoid@^3` workspace override lacks the required QNBS-v3 annotation.

## Issue Context
Add a correctly formatted annotation immediately above the changed override, explaining why the security patch is needed and its impact.

## Fix Focus Areas
- pnpm-workspace.yaml[84-84]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context

✅ Compliance rules (platform): 84 rules

Review mode: 🚀 Fast: This is a localized dependency-only security patch with aligned workspace and lockfile updates, no application logic or broad behavioral changes.

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e1095b153f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!