chore(deps): bump transitive nanoid to 3.3.18 (GHSA-2v37-7h3g-55p8)

[abbaseya]

Clears the only open Dependabot alert on main — #458, high severity.

The advisory

GHSA-2v37-7h3g-55p8 / CVE-2026-67213: in nanoid before 3.3.18, customAlphabet and customRandom never satisfy their loop exit condition when called with size: 0, so the calling thread spins forever. Denial of service for any caller that passes an unvalidated size through.

The lockfile had nanoid 3.3.17.

The fix

Three lines in yarn.lock — nanoid re-resolved from 3.3.17 to 3.3.18, the highest 3.x release (legacy dist-tag).

No package.json change and no resolutions pin. nanoid enters the tree only as a transitive dependency of postcss, and all three postcss copies already ask for a range that admits the patched version (^3.3.16 and ^3.3.17), so re-resolving the single lockfile entry is the whole fix. Produced with yarn up -R nanoid.

Blast radius

None on anything we publish. yarn why postcss shows it reaches the tree exclusively through demo-app build tooling — Next 16, Vite 7, Tailwind, @vue/compiler-sfc — so no @convertcom/js-sdk-* package ships nanoid at any version.

Verified

qa.yml reproduced command-for-command, including its job-level env so the live and live-secret integration modes actually ran rather than silently skipping:

• yarn install --immutable — passes, so the committed lockfile is complete and CI will not try to rewrite it.
• packages/js-sdk: lint clean, build clean, 169 passing (Mocha), 81 passed (Playwright — 17 full-chain tests in each of the three auth modes).
• The nine packages qa.yml does not cover, run as well: 377 passing, 0 failing.
• Cross-SDK parity, asserted against JS as a consumer: 23 contract-conformance tests plus 60 golden-vector, 9 mutual-exclusion-fixture and 2 UMD-bundle parity tests, both completeness guards firing. The shared anchored vector set is byte-identical to the published v12 copy (sha256 9993d0e6…).
• One nanoid copy on disk, at 3.3.18; yarn why nanoid shows all three postcss dependents resolving to it.
• Dependabot has no other open alert on this repo.

650 tests, 0 failures, 0 skips.

Two standing issues found while verifying — deliberately not touched here

Neither is caused by this change and both are out of scope for a security bump, but they are worth their own tickets:

1. Root yarn lint cannot pass. It exits 1 with 1,676 prettier/prettier errors in packages/types/src/config/index.ts and the generated types.gen.ts. Both files are byte-identical to main, and qa.yml only lints packages/js-sdk, so CI never sees it.
2. yarn build mutates a tracked source file. generate-rollup-config.mjs writes packages/js-sdk/package.json on every build, rewriting peerDependencies to current workspace versions and dropping the trailing newline. main has the stale >=2.x ranges committed, so any local build leaves a 24-line dirty diff nobody asked for.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JosephSamirL]

Approved via /convert:approve. An independent code review ran through /convert:review, and this issues the B-G4 human marker at 36ee225.