chore(deps): dedupe nanoid onto 3.3.17, closing the two alerts the sweep reopened

[radroid]

Fallout from #56, caught by re-checking the alert list after it merged rather than assuming the count only goes down.

Before the sweep the tree had one nanoid@3.3.12, and GHSA pingdotgg#115 / pingdotgg#116 against it sat auto-dismissed by GitHub's auto-triage rule — it was scoped as a development dependency. astro 7.2.0 restructured its dependency tree, which did two things: it added a second, already-fixed nanoid@3.3.17 alongside the old copy, and it flipped the old copy's scope to runtime. That took it out from under the auto-dismiss rule, and both alerts reopened.

So the sweep did not introduce a vulnerability — 3.3.12 was there before and was always affected — but it did change a suppressed finding into a live one, which is my problem to close either way.

One override, "nanoid@3": ^3.3.17, dedupes the two copies onto the version that was already in the tree. Both advisories want ≤ 3.3.17 (< 3.3.16 and < 3.3.17), so this clears both. Lockfile moves by 14 lines.

Ledger figures refreshed in the same commit, per SEAMS.md's self-reference rule: row 37 to +23 / risk 667, pnpm-lock.yaml to +318/-737 / risk 67520, header to 37 files / +1949 / -925.

Takes the repo to 6 open alerts, from 107 at the start of this cleanup.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9bd96a04-dd43-4412-93e5-c19f093ba5b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}