chore(deps): bump nanoid from 3.3.15 to 3.3.18

[dependabot]

Bumps nanoid from 3.3.15 to 3.3.18.

Release notes

Sourced from nanoid's releases.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

Changelog

Sourced from nanoid's changelog.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

Commits

• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• 73d6716 Release 3.3.17 version
• f9d13f1 Sync 0 size behaviour with PostCSS 5
• 9760e11 Release 3.3.16 version
• e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
• 96dd086 Update CI action
• ba0bc3b Do not create latest release for v3
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clestons]

APPROVE —— 版本 bump 本身干净(integrity 我对着 npm 核过);但它顺手把这个条目的 registry 从 npmmirror 翻到了 npmjs,全仓 1269 条里现在就这一条不一样

审的是 efee390。只改 package-lock.json 一处条目。

---

一、验过的部分

检查	结果
integrity 是不是 npm 上真实的那个	✅ npm view nanoid@3.3.18 dist.integrity → sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==,与 lockfile 里那串逐字节一致 —— 没有 tarball 掉包
bump 完整吗(有没有漏掉嵌套副本)	✅ 全 lockfile 只有 node_modules/nanoid 一条 nanoid 条目,没有第二份留在旧版本
版本范围对得上吗	✅ node_modules/postcss 声明 ^3.3.12、node_modules/next/node_modules/postcss 声明 ^3.3.6,3.3.18 同时满足,单份提升到根部是对的
影响面	nanoid 是 postcss 的传递依赖(不在 root dependencies 里),构建期用,不进运行时应用代码
改动内容	3.3.16 / 3.3.17 / 3.3.18 三个补丁全是死循环修复(negative size / zero size / async React Native)—— 是真的健壮性修复,不是空 bump

---

二、值得你决定的一条(不阻塞)

package-lock.json —— registry 从 npmmirror 翻成了 npmjs,而全仓只有这一条

-      "resolved": "https://registry.npmmirror.com/nanoid/-/nanoid-3.3.15.tgz",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",

实测这份 lockfile 里:

registry.npmmirror.com  → 1268 处
registry.npmjs.org      →    1 处   ← 就是本 PR 改的这条 nanoid

也就是说本 PR 造出了一个 1/1269 的孤例。而 .npmrc 里没有 registry= 声明(只有 legacy-peer-deps=true),所以那 1268 条 npmmirror 是当初谁在配了镜像的环境里跑 npm install 留下的,仓库层面并没有钉死。

这不是安全问题 —— integrity 校验与 registry 无关,上面已经核过是 npm 官方那串;而且方向是朝着上游规范源走(npmjs.org 是正源,npmmirror 是镜像)。

是可复现性/一致性问题:npm ci 按 resolved URL 取包。在能连 npmmirror 但连不上/连得慢 npmjs.org 的网络里(国内 CI 或本地开发常见),这一条会成为唯一一个走不通的点 —— 本来 1269 条全走镜像是通的。

两种收法,选一个就行:

• 想保持镜像一致 → 在镜像环境重跑一次 npm install nanoid@3.3.18 让它解析回 npmmirror;
• 想统一走正源 → 把整份 lockfile 一次性规范到 registry.npmjs.org(并考虑在 .npmrc 里显式钉住 registry),别留 1268:1 这种分裂。

⚠️ 顺带一提:这正是本仓 #27 那次漏掉的同一形状(npmmirror→npmjs 翻转藏在版本号 bump 里)。dependabot 默认对着 npmjs 解析,所以只要仓库实际用镜像,以后每个 dependabot PR 都会带一次这种翻转 —— 值得一次性把 registry 策略定下来,而不是每个 PR 抓一次。

---

_{2-round(纯 dependabot 版本 bump,只动 lockfile,不碰 src/):R1a DeepSeek-v4-flash findings 为空、判 trivial,R1b clean —— ⚠️ 它又一次漏掉了 registry 翻转,和本仓 #27 那次同一形状;这也说明纯看 diff 文本不足以发现「1/1269 的孤例」,必须去数整份 lockfile。机械证据:npm view nanoid@3.3.18 dist.integrity 与 lockfile 逐字节比对;grep -c 数两个 registry 在完整 lockfile 里的出现次数(1268 vs 1);解析 lockfile 的 packages 确认 nanoid 只有一条条目、两处 postcss 的声明范围都被 3.3.18 满足;拉 .npmrc 确认没有 registry 钉死。}