From 59a8f95764869e04abdfc24034f3b943d50431c2 Mon Sep 17 00:00:00 2001
From: "warp-agent-staging[bot]"
 <240773466+warp-agent-staging[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 04:16:05 +0000
Subject: [PATCH] fix: bump nanoid to 3.3.18 to resolve GHSA-2v37-7h3g-55p8

Update the transitive, dev-scoped nanoid dependency (pulled in by
postcss via prettier-eslint) from 3.3.16 to 3.3.18, fixing an infinite
loop in customAlphabet/customRandom when called with size 0 that could
hang the calling thread (DoS). Lockfile-only change; nanoid has no
first-party call sites in this repo.

Co-Authored-By: Warp <agent@warp.dev>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b7aa643..fe2f851 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3481,9 +3481,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {