fix(security): nanoid updated due dependabot warnings

[WebReflection]

What changed

Bump the transitive nanoid dependency from 3.3.17 to 3.3.18 to resolve Dependabot alert GHSA-2v37-7h3g-55p8 (nanoid: custom generators can loop indefinitely when size is zero, high severity).

• bun.lock: nanoid 3.3.17 -> 3.3.18
• packages/kilo-docs/pnpm-lock.yaml: nanoid 3.3.17 -> 3.3.18
• package.json: added nanoid: ">=3.3.18" override to prevent regression
• Added a changeset

Why

Dependabot flagged nanoid (< 3.3.18) as vulnerable to an infinite loop when customAlphabet/customRandom are called with a size of 0. The patched version for the 3.x line is 3.3.18.

Testing

• bun install --frozen-lockfile passes (lockfile consistent with the new override).
• packages/kilo-docs vitest suite passes (22/22).
• The full packages/opencode test suite has pre-existing failures unrelated to this change (Telemetry.trackSuggestionShown is not a function, InstanceRuntime.disposeDirectory is not a function, and a yield* Global.Service TypeError in effect-flock.ts). The suggestion tests pass in isolation (12/12), confirming order-dependent test pollution rather than a regression from this dependency bump.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• bun.lock
• package.json

Previous Review Summary (commit 7f37841)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 7f37841)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• .changeset/nanoid-security-update.md
• bun.lock
• package.json
• packages/kilo-docs/pnpm-lock.yaml

---

_{Reviewed by grok-4.6 · Input: 63.3K · Output: 4.3K · Cached: 156K}

_{Review guidance: REVIEW.md from base branch main}

[WebReflection]

Kilo warned me about jetbrain not being testable but it looks like updating this in there too breaks it ... @kirillk any clue why would that be? the updated version is a patch, not even a minor, why would jetbrain fail all over?