fix(deps): bump nanoid and fast-uri past their advisories

[kojiwakayama]

Closes both open high-severity Dependabot alerts on main.

What they are

Both resolve into the root deno.lock as transitive npm dependencies of extensions:

Package	Was	Now	Reached via	Advisory
nanoid	3.3.16	3.3.18	purgecss@8.0.0 → postcss (ext-css-purgecss)	GHSA-2v37-7h3g-55p8 — custom generators can loop indefinitely when size is 0
fast-uri	3.1.4	3.1.5	ajv@8.18.0 (ext-schema-zod)	host confusion via a backslash in the authority

#3466 already bumped nanoid, but in storybook/package-lock.json — a separate surface. The deno.lock copy was never moved, which is why the alert stayed open. The integrity hash for 3.3.18 here matches the one that PR landed, which is an independent check that this is the right tarball.

Why the lock alone

Both dependents reference the bare package name in deno.lock, so bumping the key and integrity is sufficient — neither extension's deno.json pins a range that needed to move.

Verification

• deno check passes on both extensions/ext-css-purgecss/src/index.ts and extensions/ext-schema-zod/src/index.ts, so Deno re-resolved and integrity-verified both new tarballs
• The lock did not drift: the diff is exactly the four intended lines
• Extension tests: 6 passed / 3 failed both with and without this bump. The three failures (GCS blob storage, S3 blob storage, ws package boundary) are pre-existing and unrelated — I stashed the change and re-ran to confirm, since the ws test is a package-boundary check that could plausibly have been affected

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• deno.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e95e8f33-3792-4f39-acbf-8e714bdc2c68

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}