chore: pin nanoid to 3.3.17 to remediate CVE-2026-67213

[devin-ai-integration]

Summary

nanoid@3.3.16 was pulled in transitively (vite → postcss → nanoid) and is affected by CVE-2026-67213 (fixed in 3.3.17). Added a pnpm override alongside the existing undici one:

 "pnpm": { "overrides": {
     "undici": "^6.27.0",
+    "nanoid": "3.3.17"
 } }

Pinned exactly rather than ^3.3.17 because ^ resolves to 3.3.18, published 5 days ago and not yet vetted; 3.3.17 already contains the fix and satisfies postcss's ^3.3.11 range. Dev/build-only dependency — no change to published package deps.

Lint, typecheck, build and the node+edge test suites (146 tests) pass.

Link to Devin session: https://app.devin.ai/sessions/8fce511c91554f5f94ad220fdbc30f99
Requested by: @requesty-ditti

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 64fc50f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR