From e1095b153f135cc84bab8862ff8f26bdec65c454 Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 19:02:14 +0200
Subject: [PATCH 1/2] fix(deps): patch nanoid security advisory

---
 pnpm-lock.yaml      | 10 +++++-----
 pnpm-workspace.yaml |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 85e8ab15..047780d7 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -28,7 +28,7 @@ overrides:
   '@babel/core': '>=7.29.6 <8'
   undici: '>=7.29.0 <8'
   js-yaml: '>=4.3.1 <5'
-  nanoid@^3: 3.3.17
+  nanoid@^3: 3.3.18
   nanoid@^5: 5.1.16
   adm-zip: '>=0.6.0'
   postcss: '>=8.5.18'
@@ -5993,8 +5993,8 @@ packages:
     resolution: {integrity: sha512-dkEJPVvun4FryqBmZ5KhDo0K9iDXAwn08tMLDinNdRBNPcYEDiWYysLcc6k3mjTMlbP9KyylvRpd4wFtwrT9rw==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  nanoid@3.3.17:
-    resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -13770,7 +13770,7 @@ snapshots:
 
   mute-stream@3.0.0: {}
 
-  nanoid@3.3.17: {}
+  nanoid@3.3.18: {}
 
   nanoid@5.1.16: {}
 
@@ -14151,7 +14151,7 @@ snapshots:
 
   postcss@8.5.23:
     dependencies:
-      nanoid: 3.3.17
+      nanoid: 3.3.18
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 80352afc..b6708caf 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -81,7 +81,7 @@ overrides:
   "@babel/core": ">=7.29.6 <8"
   undici: ">=7.29.0 <8"
   js-yaml: ">=4.3.1 <5"
-  nanoid@^3: "3.3.17"
+  nanoid@^3: "3.3.18"
   nanoid@^5: "5.1.16"
   # QNBS-v3 (2026-07-26): GHSA batch blocking the CI security gate — transitive-only dev paths.
   adm-zip: ">=0.6.0" # GHSA-xcpc-8h2w-3j85 — 4GB memory allocation via crafted ZIP (onnxruntime-node)

From 61df5abc7e2097f4f153c818fb3afb35288ac737 Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Thu, 13 Aug 2026 19:06:59 +0200
Subject: [PATCH 2/2] fix(deps): allow patched nanoid release

---
 pnpm-workspace.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b6708caf..aea6fd3f 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -13,6 +13,8 @@ sideEffectsCache: true
 strictDepBuilds: true
 blockExoticSubdeps: true
 minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - nanoid@3.3.18
 
 # QNBS-v3: Migrated from package.json "pnpm" field (deprecated in pnpm v10+)
 # Overrides with security justifications: