security(deps): require nanoid 3.3.18 remediation

[seonghobae]

Purpose

Test-first remediation for #271 and GHSA-2v37-7h3g-55p8. Protected main locks nanoid@3.3.17; this pull request advances only the transitive lock identity required by the current high-severity audit contract to patched nanoid@3.3.18.

Exact identities

• protected base: 6bc8ed016dc07f95d4e041a3b79ac00c4086b182
• RED head: 5a20b101830dc948624e77f668693a1ab4f17caf
• current GREEN head: 53915fbd8f316c0de8f2834554ef29338cec9d6e
• branch: fix/nanoid-cve-2026-67213-3-3-18

The RED changed only the existing predecessor-integration contract from 3.3.17 to 3.3.18, leaving package and lockfile bytes unchanged. Exact-head application CI then failed with expected 3.3.18, received 3.3.17, while the remaining test suite and security evidence stayed separate from that failure.

GREEN implementation

Using the repository-reviewed Node 24.19.0 / npm 11.17.0 toolchain, the GREEN:

• regenerated the lockfile through npm registry metadata rather than hand-editing it;
• changed only node_modules/nanoid identity fields from 3.3.17 to 3.3.18;
• binds the exact registry URL and SHA-512 integrity in the durable regression test;
• supplies the repository-required schema-v3 lockfile change policy bound to the exact protected base, before/after package-object digests, unchanged top-level metadata digest, bounded justification, and HTTPS provenance;
• preserves PostCSS's declared ^3.3.16 dependency range and all unrelated package metadata;
• corrects stale changelog statements that described 3.3.17 as the current remediation;
• leaves no temporary repair workflow in the final tree.

The authenticated package identity is:

version:   3.3.18
resolved:  https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz
integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==

Verification boundary

One-shot run 31782767823 completed frozen install and the full repository release:verify contract before committing the minimal package GREEN. Its bot-authored synchronization runs were action_required and are not treated as passing evidence. Follow-up exact-head commits added durable registry-identity assertions and the explicit lockfile policy required by protected CI. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must all complete successfully on unchanged current head 53915fbd8f316c0de8f2834554ef29338cec9d6e before merge.

No audit waiver, ignore, severity downgrade, fabricated integrity, unrelated dependency churn, gate weakening, protection bypass, version bump, release, or deployment claim.

Related: #271, #269.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9eb96bdd-f43a-40f4-9873-748fd8dcace5

📥 Commits

Reviewing files that changed from the base of the PR and between 6bc8ed0 and 573069c.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• CHANGELOG.md
• test/package-manager-predecessor-integration.test.ts

---

📝 Walkthrough

Walkthrough

nanoid의 transitive lockfile 해석이 3.3.17에서 3.3.18로 갱신되었다. 통합 테스트는 버전, resolved URL, integrity 값을 함께 검증한다. 기존 보안 게이트와 npm 설치 계약은 유지된다.

Changes

nanoid 잠금 파일 갱신

Layer / File(s)	Summary
잠금 파일 및 통합 검증 갱신 test/package-manager-predecessor-integration.test.ts, CHANGELOG.md	통합 테스트가 nanoid의 버전, resolved, integrity 값을 검증한다. 변경 기록은 nanoid 3.3.18과 관련 보안 수정 참조를 반영한다. 기존 검증 계약과 테스트 구조는 유지된다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 57306

This PR makes a narrowly scoped nanoid remediation update with no actionable merge-blocking risk remaining; it is merge-ready after the normal required checks complete.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보안 취약점 해결을 위한 nanoid 3.3.18 업데이트라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nanoid-cve-2026-67213-3-3-18

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review the unchanged exact GREEN head 573069c38a5936264d75f7efe87ca2d728bcca17, including the authenticated nanoid@3.3.18 lock identity, changelog correction, and durable registry-integrity regression. Do not transfer conclusions from the RED or intermediate bot-authored head.

[coderabbitai]

@seonghobae I will review pull request #272 at exact head 573069c38a5936264d75f7efe87ca2d728bcca17. I will assess only that head and the specified lock identity, changelog correction, and durable regression coverage.

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please re-review exact current head 53915fbd8f316c0de8f2834554ef29338cec9d6e. The new .github/lockfile-change-policy.json is a closed schema-v3 authorization bound to exact protected base 6bc8ed016dc07f95d4e041a3b79ac00c4086b182. Verify the package-object and top-level metadata digests, bounded provenance, and the previously reviewed nanoid@3.3.18 registry identity. Do not transfer conclusions from an earlier head.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 10 minutes and 6 seconds before sending another message.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 9 minutes and 58 seconds before sending another message.