fix(security): remediate npm audit findings (nanoid)

[Vijay431]

Summary

Daily security audit found one high-severity advisory. This PR remediates it via a pnpm override, with no direct package.json changes.

CVE details

Package	Severity	Vulnerable range	Patched range	Advisory
nanoid	High	<3.3.18	>=3.3.18	GHSA-2v37-7h3g-55p8 — custom generators can loop indefinitely when size is zero

• Resolved via: pnpm-workspace.yaml overrides (dev-only transitive dependency, path postcss > vite > vitest) — not a direct dependency, so no package.json bump.
• Old → new: nanoid@3.3.16 → nanoid@3.3.18
• Override added: nanoid: '^3.3.18' — pinned to the 3.x line (not the loose >=3.3.18, which pnpm resolves to nanoid@6.0.1, an ESM-only package incompatible with postcss's declared ^3.3.11 CJS-era dependency). postcss's own dependencies.nanoid range (^3.3.11) is satisfied by 3.3.18.

Version verification (npm view)

• npm view nanoid versions --json — confirmed 3.3.18 exists on the registry.
• npm view nanoid@3.3.18 version / type main — confirmed 3.3.18 is real, still CJS-compatible (main: index.cjs), matching the tree's existing nanoid@3.x shape.
• Confirmed postcss@8.5.25's own manifest declares nanoid: ^3.3.11, so 3.3.18 satisfies its peer/dependency constraint without forcing a major bump.

Type of change

• Bug fix
• Feature
• Documentation
• Refactor
• CI/build tooling
• Maintenance

Verification

• pnpm run lint — 0 errors, 2 pre-existing warnings in codeAnalysisService.ts (unrelated to this change)
• pnpm run build — succeeds, main bundle 469.23 KB
• pnpm run test:unit — 124/124 tests passed across 13 files
• pnpm run test:unit:coverage — not run (out of scope for this audit)
• pnpm run test:integration — skipped (no display/xvfb available in this environment)
• Manual VS Code Extension Development Host check — not applicable, no runtime code changed

Final pnpm audit --audit-level=low

No known vulnerabilities found

pnpm run build output

✅ Build completed successfully!
📦 Main bundle (optimized): 469.23 KB
📦 Lazy services total: 626.64 KB
📦 Total size: 1095.87 KB

pnpm run test:unit output

Test Files  13 passed (13)
     Tests  124 passed (124)

Screenshots or recordings

N/A — dependency-only change, no UI impact.

Checklist

• I updated docs or changelog entries when user-facing behavior changed. (Added CHANGELOG.md entry under [Unreleased] > Fixed)
• I avoided generated output in dist/, out-test/, and compiled .js/.map files.
• I kept the PR focused and within the repository commit-size guidance. (3 files changed: pnpm-workspace.yaml, pnpm-lock.yaml, CHANGELOG.md)

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f0d97e26-2c12-41bc-8e21-5a7fc2e03d36

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}