chore: update nanoid to 3.3.18, clearing the last advisory

[zerotrustdavid]

Closes Dependabot alert #6. Three lines in the lockfile, and npm audit goes to zero.

The alert is wrong, and its own text contains the refutation

Dependabot cannot update nanoid to a non-vulnerable version. The latest possible version that can be installed is 3.3.16 because of the following conflicting dependency:

• @tailwindcss/postcss: requires nanoid@^3.3.16
• next: requires nanoid@^3.3.16

Both constraints are ^3.3.16. The caret range means >=3.3.16 <4.0.0, which admits 3.3.18. The named "conflicting dependencies" do not conflict with the fix.

And 3.3.18 exists. From the registry:

3.x published: 3.3.11 … 3.3.15, 3.3.16, 3.3.17, 3.3.18
dist-tags: { legacy: 3.3.18, latest: 6.0.1 }

Nothing in the tree ever forbade it. The lockfile was simply pinned at 3.3.16, and no top-level bump existed to make Dependabot revisit the entry.

Why Dependabot said otherwise

It resolves a transitive advisory by looking for a release of the package that introduces the dependency. Neither @tailwindcss/postcss nor next has published one that raises its own nanoid floor, so it reported the update as impossible.

It is not impossible. It just is not reachable by the strategy Dependabot uses. The distinction matters, because the alert's suggested fallback was an overrides entry — a permanent, hand-maintained pin that would then need removing later. None of that is necessary.

The change

npm update nanoid --package-lock-only

package-lock.json	3 insertions, 3 deletions
package.json	unchanged
overrides entry	not needed
nanoid	3.3.16 → 3.3.18
npm audit	1 high → 0

Verified

Check	Result
npm install --ignore-scripts	clean, nanoid resolves to 3.3.18
npm run lint	clean
npx tsc --noEmit	clean
npm run build	clean
npm run brand	15 files, byte-identical, so the #17 guard passes
npm audit	found 0 vulnerabilities

What this means for the standing position

F25 was recorded as an accepted open advisory with the constraint named. That record was accurate about what the alert said and wrong about what was possible. It should be closed as resolved, not accepted.

Worth keeping as a general point: a tool reporting that it cannot fix something is a statement about the tool's strategy, not necessarily about the dependency graph. The semver ranges were readable, and reading them took less time than writing the acceptance rationale did.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
invisionsolutions	Ready	Preview	Aug 27, 2026 12:31am