fix(deps): override nanoid to 3.3.18 to patch high-severity vulnerabi…

[YuryShkoda]

Issue

npm audit flags a high-severity nanoid vulnerability (GHSA-2v37-7h3g-55p8, and GHSA-28wg-ghj8-5hjv — both fixed in nanoid@3.3.17) reachable from a production dependency chain:

@sasjs/cli@4.18.4
└─ node-powershell@5.0.1
   └─ child-shell@5.0.0
      └─ nanoid@3.3.9  (^3.1.30 range, vulnerable)

child-shell@5.0.0 — the latest published version, already what node-powershell@5.0.1 depends on — declares "nanoid": "^3.1.30", a range that permits anything up to (but not including) 4.0.0, including every vulnerable 3.x release. Bumping node-powershell/child-shell doesn't help since both are already at their latest versions; the loose range itself is the problem, not a stale pin.

Intent

Eliminate the vulnerable nanoid resolution from @sasjs/cli's own published dependency tree without waiting on an upstream child-shell release, and without changing any node-powershell/child-shell behavior — nanoid's public API is unchanged between the vulnerable and patched versions within the 3.x line.

Implementation

• Added a nanoid entry to the existing overrides block in package.json, pinning it to 3.3.18 (latest 3.x patch release, well within child-shell's own ^3.1.30 range so no code changes are required):

  "overrides": {
    "ws": "8.21.0",
    "nanoid": "3.3.18"
  }

• Regenerated package-lock.json — npm ls nanoid now shows nanoid@3.3.18 overridden under child-shell.
• npm audit fix also cleared two unrelated, freshly-disclosed advisories (brace-expansion, js-yaml) picked up in the same pass. npm audit now reports 0 vulnerabilities.

Checks

• Code is formatted correctly (npm run lint:fix).
• Any new functionality has been unit tested.
• All unit tests are passing (npm test).
• Unit tests coverage has been increased and a new threshold is set.
• All CI checks are green.
• Development comments have been added or updated.
• Development documentation coverage has been increased and a new threshold is set.
• Reviewer is assigned.

Reviewer checks

• Any new code is documented.

[github-actions]

Coverage report

Total coverage

Status	Category	Percentage	Covered / Total
🟡	Statements	74%	3341/4515
🟡	Branches	60.67%	1325/2184
🟡	Functions	74.02%	678/916
🟢	Lines	82.72%	8480/10252

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Show files with reduced coverage 🔻

Reduced coverage

Status	Filename	Statements	Branches	Functions	Lines
🟡	src/utils/config.ts	58.29%	55.52%	63.79% (+1.72% 🔼)	64.57%
🟢	src/utils/test.ts	84.66% (-1.14% 🔻)	68.12%	77.14%	92.14%
🟢	src/commands/compile/compileSingleFile.ts	95.83% (-2.08% 🔻)	84% (-4% 🔻)	100%	100%

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Report generated by 🧪jest coverage report action from c776770