fix: update nanoid to resolve CVE-2026-67213

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

• Dependency: nanoid (transitive, via postcss) pinned to ^3.3.17 via overrides in package.json; resolves to 3.3.18 after npm install
• Advisory: CVE-2026-67213 / GHSA-2v37-7h3g-55p8 (custom generators can loop indefinitely when size is zero)
• Dependabot alert: https://github.com/warpdotdev/docs/security/dependabot/49
• Verification: npm install succeeded cleanly, npm audit no longer reports nanoid, npm run build completed successfully (364 pages built)

Highlight the risky code / where the dependency was used

nanoid is a transitive dependency of postcss (build tooling only, not used directly in site code). No source files reference nanoid directly.

Special instructions for this PR

None — straightforward transitive dependency pin using the existing overrides pattern already used in package.json for other transitive deps.

AFTER YOU MERGE

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		Aug 10, 2026 1:06pm

[oz-for-oss]

@independabot-soc2[bot]

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR adds a package override for the transitive nanoid dependency and updates the lockfile so it resolves to 3.3.18, addressing the reported vulnerability without changing site source code. I reviewed the dependency update, lockfile changes, security impact, and available spec context.

Concerns

• No blocking correctness, security, or spec-alignment concerns found in the annotated diff.
• spec_context.md reports no approved or repository spec context for this PR.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz