chore(deps): bump nanoid from 3.3.16 to 3.3.19

[dependabot]

Bumps nanoid from 3.3.16 to 3.3.19.

Release notes

Sourced from nanoid's releases.

3.3.19

• Fixed killing the app by setting huge user ID.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

Changelog

Sourced from nanoid's changelog.

3.3.19

• Fixed killing the app by setting huge user ID (by @​geoffrey-diederichs).

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

Commits

• eb63bd6 Release 3.3.19 version
• 9067e03 Sync CJS and ESM
• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• 73d6716 Release 3.3.17 version
• f9d13f1 Sync 0 size behaviour with PostCSS 5
• See full diff in compare view

[PeterGuy326]

HOLD — no checks are reported for current head and no formal review exists yet. This is a bounded dependency-only pass with no code blocker identified; please trigger the repository CI against the exact head and obtain a non-author review before merge.

[PeterGuy326]

Independent automated preflight — PASS (dependency-only scope)

Head: 014b61bcf33c6a8585984a604cee967a8cddb08e. This updates the earlier CI-pending note; it is not a human approval or a merge request.

• Reviewed the entire diff: only package-lock.json changes. The only changed package version is nanoid 3.3.16 → 3.3.18; the other differences are npm peer metadata. Public React peer declarations and source code are unchanged.
• Verified the nanoid tarball URL and SHA-512 integrity independently against the npm registry.
• Clean isolated install on macOS arm64, Node 24.13.0/npm 11.6.2: PASS.
• Replayed npm run check: formatting, lint, typecheck, all 18 unit tests, package/showcase builds, all 206 distributed token variables, and packed-consumer install/ESM/CJS/TypeScript checks passed.
• Local visual qualification: the initial four-worker run hit page-setup timeouts under load. A single-worker replay passed keyboard/reduced-motion, collapsed-label accessibility, and dialog-centering tests. The screenshot case cannot compare on macOS because the repository tracks Linux snapshots only. I did not bless generated Darwin snapshots or count them as a passing comparison. No tracked files were modified.
• The exact-head Linux check job passed, as did dependency review and CodeQL. That is the Linux screenshot evidence, not the local macOS run.

No dependency-update blocker found. Human review and repository merge gates remain separate. This does not claim full macOS visual acceptance.

[waterbro-8]

Not a review, not an approval, carries no vote, does not ask to merge or close.

First-pass evidence for this PR, asked for by 胡奕舟 on 2026-09-09 ("design-system：#22，首次
review" / "每条在 PR 留负责人、修复 commit、回归和 CI 证据" / "本轮先不合并"). Permission
readout for bytefolk/design-system at posting time:
{"admin":false,"maintain":false,"pull":true,"push":false,"triage":false} — comment-only here,
so nothing below is an action I can or should take.

PeterGuy326 already posted a diff read, an integrity check against the registry, an isolated
install and a full npm run check replay on this head at 2026-09-10T04:20:06Z. I am not
repeating any of that. Sections 1–5 below are the parts that thread does not cover, plus one
correction to the earlier note it supersedes.

1. 负责人

• Author is dependabot[bot], so per "Dependabot 的修复指定真人接手" this still has no named
  human taker. assignees: []; requested_reviewers: ['PeterGuy326','Bindy-lbb'];
  .github/CODEOWNERS at this head is 3 lines whose only rule is * @PeterGuy326 @Bindy-lbb.
• Not me: the permission readout above gives me neither push nor triage on this repo, and I
  authored nothing here.

2. 修复 commit

None exists and none is needed — the whole change is one file, and I found nothing in it that
requires a fix commit. What the PR is:

• head 014b61bcf33c6a8585984a604cee967a8cddb08e (single commit, authored 2026-09-05T14:57:45Z) ·
  base 72663f01216491d4d2bd6ab241fb22b359dfb724, which is today's main tip and is the
  merge base (compare/main...head = status=ahead / ahead_by=1 / behind_by=0) ⇒ not behind, not
  conflicting.
• package-lock.json only, +12/−28. Of those 40 lines, exactly 3 change an observable value:
  nanoid's "version" 3.3.16→3.3.18, its "resolved" and its "integrity". The remaining 37 are
  npm regeneration churn: 6 "peer": true added vs 22 removed (net −16), and 3 "license": "MIT"
  lines re-emitted on each side. That net −16 is inert for npm ci; it is not a removal of a peer
  relationship.

3. 回归 / CI 证据 — live on the exact current head

check-runs for 014b61bc… (deduplicated per name by max check_suite.id; each line below is
check-run id in suite <check_suite.id>) — 4 names, all completed / success:

• check — run 101325666220 in suite 92063561185
• Dependency review — run 101325666221 in suite 92063561170
• CodeQL (javascript-typescript) — run 101325666243 in suite 92063561170
• CodeQL — run 101325771675 in suite 92063663217

reviews: [].

So the mergeable_state = blocked here has exactly one cause: no non-author review. Not a red
check, not a conflict, not a stale branch. The HOLD left on 2026-09-09T18:18:51Z said "no checks
are reported for current head"; that was true when written and 04:20Z's comment already supersedes
it — recording it here so nobody re-reads that HOLD as an open finding.

What that thread does not contain: a local run on Linux (its isolated install is macOS arm64 /
npm 11.6.2), and line-level reads of the CI jobs it links but does not quote.

• Provenance first, so "what I measured" and "what is on the branch" are the same object:
  git write-tree on the unpacked head = 58c7b51ecb722c8528efe3d7aa0b36e4e429b724, which equals
  the remote git/commits/014b61bc….commit.tree.sha ⇒ byte-identical tree, zero git transport used.
• npm ci --ignore-scripts here: node v24.19.0 / npm 12.0.2 (the CI leg runs npm 11.19.0) →
  rc=0, added 478 packages, and node_modules/nanoid/package.json reads 3.3.18. Same package
  count as CI's added 478 packages, and audited 479 packages, so the two installers resolve this
  lock identically across a major-version gap.
• From the exact-head Linux check job log: :152 found 0 vulnerabilities, :418 Test Files 4 passed, :419 Tests 18 passed, :459 Dist tokens drift check passed: 206 token variables intact, :464 Packed consumer: install, TypeScript, and runtime preset checks passed.
• From the Dependency review job log: :160 fail-on-severity: high, :166 did not detect any vulnerable packages with severity level "high" or higher, and it names the bump itself at
  :177 - nanoid@3.3.16 / :178 + nanoid@3.3.18.

4. Is 3.3.18 the right target? Yes, and with no lag of either kind

This is the check that made mem#187 worth an issue, so it is worth saying explicitly here:
04:20Z's comment verified the artifact, not the version choice.

• Advisory closure. advisories?affects=nanoid returns 5; every 3.x
  first_patched_version is ≤ 3.3.18, and the one this PR answers —
  GHSA-2v37-7h3g-55p8 / CVE-2026-67213, < 3.3.18 → patched 3.3.18, published_at
  2026-07-29T15:31:12Z — is closed exactly. The other four (3.3.12 / 3.3.16 / 3.3.8 / 3.1.31) were already covered below
  this version. ⇒ no advisory lag: there is no fixed-and-advisory-backed 3.x above what
  Dependabot picked.
• Upstream lag. Registry dist-tags = {'legacy': '3.3.18', 'latest': '6.0.1'} and 3.3.18 is
  the highest 3.x published ⇒ the floor cannot drift ahead of this pin the way pypdf's does.
  3.3.18's dist.integrity and dist.tarball match this lock's values verbatim.
• Severity. severity: high; CVSS v3.1 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H and
  v4.0 8.2 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (both from the advisory
  payload's cvss_severities); CWE-835 "Loop with Unreachable Exit Condition ('Infinite
  Loop')" — that one is only on the single-advisory endpoint's cwes, the list payload returns
  cwe_ids: null. An infinite loop in customAlphabet / customRandom when configured with
  size 0.

5. Why this lock cannot desync, and what the CVE actually reaches here

• The structural test bytefolk/doc#39 fails and this one cannot. The question is not the lock format —
  both repos are on lockfileVersion 3 with top-level keys exactly ['lockfileVersion','name', 'packages','requires','version'] and no legacy top-level dependencies. It is whether any
  lock entry declares the bumped name at the version being moved. In bytefolk/doc two entries
  do, as exact pins: packages[""] (@fullstack-ai-infra/doc@0.1.0) and
  packages["services/collaboration"] (@fullstack-ai-infra/doc-collaboration@1.0.0) each carry
  "nodemailer": "8.0.11", backed by nodes node_modules/nodemailer@8.0.11 and
  node_modules/@types/nodemailer@7.0.12. doc#39 is one file, services/collaboration/package.json
+1/−1 (its :39 now reads "nodemailer": "9.0.1",) and never re-locks ⇒ two mirror lines
  fall out of step and npm ci dies on the delta. Here the answer is the inverse, and measurable:
  the root entry's four dependency-ish sections are dependencies, devDependencies,
  peerDependencies, peerDependenciesMeta and none of them names nanoid; the only
  declarer of the name anywhere in the lock is node_modules/postcss → "nanoid": "^3.3.16", and
  ^3.3.16 accepts 3.3.18. There is exactly one nanoid node, and no manifest names it: grep -rn nanoid package.json → 0, and repo-wide grep -rln --exclude-dir=node_modules --exclude=package-lock.json '"nanoid"' . → 0 files. ⇒ there is no mirror line to move, so
  this class of failure is not expressible in this repo.
• Reachability, stated honestly. The one reachable use of the name is postcss's
  lib/input.js:3 let { nanoid } = require('nanoid/non-secure') → :80 this.id = '<input css ' + nanoid(6) + '>', a fixed size of 6. The advisory's named functions have zero call sites in
  this tree: grep -rnoE 'custom(Alphabet|Random)\(' outside node_modules/nanoid/ → 0 hits,
  across node_modules, src/, scripts/ and tests/ alike. The name mentions outside the
  package are 4 lines, none of them a call: tailwindcss/peers/index.js:1596 (var customAlphabet = (alphabet, defaultSize = 21) =>, a definition) and :1614 (module2.exports = { nanoid, customAlphabet }, an export), plus the same bundled code minified into
  prettier/plugins/postcss.js:20 / postcss.mjs:20. customRandom appears nowhere outside
  node_modules/nanoid/ at all.
• But do not call this dev-only. npm ls --omit=dev still contains the chain: root
  dependencies has "@tailwindcss/forms": "^0.5.11" → tailwindcss@3.4.19 → postcss@8.5.25 →
  nanoid@3.3.18 (a --omit=dev install of this tree gives 193 packages and keeps all four). So
  nanoid ships inside the published package's production graph. npm ls --all on a full install:
  @fullstack-ai-infra/ui@0.2.0 └─┬ tailwindcss@3.4.19 └─┬ postcss@8.5.25 └── nanoid@3.3.18.
  Net for the taker: take the bump (it is free and closes the advisory) while the practical
  exposure of not taking it is a DoS path that this repo does not call.

6. The required Scorecard gap on this repo, and the fix shape

胡奕舟's instruction for doc / design-system was: "共同缺 required Scorecard：现有 workflow 只在
主干跑，先整理修正方案，不要直接放宽保护或绕过检查".

• Confirmed here, from the file at this head: .github/workflows/bytefolk-scorecard.yml, 49 lines,
  md5 f3c8c27c15ced9d143714b579a0df7a9 — byte-identical to the copy on mem's main, so one
  fix serves both. Its on: is push: branches:[main] (:4-6), schedule (:7-8) and
  workflow_dispatch (:9). There is no pull_request: ⇒ a workflow that can never produce a
  report for a PR, which is why no Scorecard leg appears among this head's 4 check names.
• One limitation on this claim, stated rather than papered over: I have no admin right here, so I
  cannot read branch protection and cannot independently confirm Scorecard is configured as
  required in this repo. What I can confirm is the mechanism and the observed absence.
• The fix is not to add pull_request: to that file, and measured reason exists: that file's
  :36 runs publish_results: true, i.e. it writes results to the project's public profile — you
  do not want that from a PR run. bytefolk/digital-employee#263 (open, in-repo head
  6432db6a2d4684944b6e52b72df5c48828c74fe5) is the shape to adopt: a separate
  .github/workflows/scorecard-pr.yml, pull_request-only, with publish_results: false at
  :30, and it ships a guard test for itself (tests/scripts/scorecard-workflow.test.ts,
  +132) so the reportable-on-PR property has an owner. Its head reports
  OpenSSF Scorecard = completed / success ⇒ this is a working fix, not a proposal.

7. Two local divergences that are not findings against this PR

Both reproduced on main with the two trees' package-lock.json blobs verified distinct
(3b40dc43664d7a376c0d517d21573a1f head / 57a6b604b6c4568629a845841dd5769b main), so neither is
caused by this change:

• npm run test:pack fails on both trees at scripts/test-pack-consumer.mjs:39:26 with
  TypeError: object is not iterable. :34-39 destructures const [{ filename }] = JSON.parse(packOutput), which assumes npm pack --json returns an array; npm 12.0.2 returns an
  object, CI's npm 11.19.0 returns an array (CI :464 proves this leg green). Pre-existing,
  npm-major-dependent, out of scope here — worth its own issue, not a blocker on this one.
• Local npm audit cannot run on this machine at all: 404 Not Found - POST https://registry.npmmirror.com/-/npm/v1/security/advisories/bulk - [NOT_IMPLEMENTED] /-/npm/v1/security/* not implemented yet. This host's mirror does not implement the endpoint, so
  the only audit evidence available is CI's (:152 found 0 vulnerabilities and dependency-review
  :166), which is what §3 cites.

8. What I did not do

No review submitted, no vote, no merge, nothing closed, no Update branch, no label or assignee
change (no triage right here), no push, no re-lock, no protection or threshold change, no workflow
file touched. doc#39, mem#187 and digital-employee#263 are cited as contrast or as a measured
fix shape only.

[PeterGuy326]

Routine dependabot bump (nanoid 3.3.16 -> 3.3.18). Dependency review and check suite green. Approving.

[PeterGuy326]

Routine dependabot bump (nanoid 3.3.16 -> 3.3.18). Re-approving after dependabot rebased onto current main; all four required checks (check, CodeQL javascript-typescript, Dependency review, OpenSSF Scorecard) are green on this head.