chore: upgrade nanoid to ^3.3.18 to address CVE-2026-67214

[claude]

Refreshes the nanoid lockfile entries so the vulnerable 3.3.12 instance (pulled in transitively by postcss@8.5.15) is gone. Both existing entries dedupe onto a single patched resolution.

• nanoid 3.3.12 -> 3.3.18 (patched floor 3.3.16)
• The separate ^3.3.16 entry also lands on 3.3.18

The existing ^3.3.12 range already admitted a patched version, so no package.json change or resolutions override was needed. Only yarn.lock changes.

Advisory addressed

• CVE-2026-67214: infinite loop in customAlphabet and nanoid from nanoid/non-secure when given a negative size. Fixed in 3.3.16 / 5.1.16.

Verification

• yarn install --immutable
• yarn why nanoid reports a single resolution, nanoid@npm:3.3.18; no 3.3.12 instance remains
• yarn test passes (1954 tests across queryLanguage, shared, backend, web)

Note: #1599 (postcss) touches the same yarn.lock region, since bumping postcss off 8.5.15 also removes the vulnerable nanoid request. Whichever merges second may need a trivial lockfile rebase.

Fixes SOU-2000

🤖 Generated with Claude Code

---

Note

^{Cursor Bugbot is generating a summary for commit a43b9b3. Configure here.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.

[brendan-kellam]

Superseded by #1603, which restored nanoid@3.3.18 on main.