fix(deps): resolve both open Dependabot alerts (nanoid, js-yaml)

[ArnasDon]

Closes the two remaining open Dependabot alerts (#81, #80). Both are transitive dependencies in the root package-lock.json; no direct dependency changes.

Alert	Advisory	Severity	Package	Was	Now
#81	GHSA-2v37-7h3g-55p8	High (CVSS 5.9)	nanoid	3.3.16	3.3.18
#80	GHSA-5p4m-2wfm-xmqj (CVE-2026-59870)	High (CVSS 7.5)	js-yaml	4.3.0	4.3.1

• nanoid — custom generators can loop indefinitely when size is zero. Sole consumer is postcss (nanoid@^3.3.16).
• js-yaml — quadratic CPU consumption in !!omap resolution. Consumers are @eslint/eslintrc (^4.1.1) and cosmiconfig (^4.1.0).

Approach

Raised the floors in overrides rather than relying on lockfile resolution — overrides is this repo's security-floor mechanism (postcss, js-yaml, sharp, brace-expansion entries are all floors), and without it the alerts silently reopen on the next resolve.

Both advisories also cover a second major line (nanoid 4.0.0–5.1.5, js-yaml 3.x). Neither is present in the tree, so plain caret floors on the resolved lines are sufficient and cannot drag a consumer across a major — no version-scoped override keys needed here.

Lockfile regenerated with npx npm@10 install --package-lock-only, matching packageManager and CI's Node 20 npm.

Verification

Programmatic before/after diff of every lockfile entry — only two entries changed, nothing added or removed:

CHANGED:
  node_modules/js-yaml  4.3.0  -> 4.3.1
  node_modules/nanoid   3.3.16 -> 3.3.18
ADDED:    (none)
REMOVED:  (none)

@swc/helpers occurrence count still 7 — the nested optional-peer entry that npm ci requires is intact.

All four CI steps run locally on the branch:

Step	Result
npm ci (npm 10)	pass — found 0 vulnerabilities
npm run lint	pass — 37 warnings, 0 errors (unchanged from main)
npm run typecheck	pass
npm test	pass — 78 files, 796 tests
npm run build	pass

Installed tree confirmed: single copy of each package, nanoid@3.3.18 and js-yaml@4.3.1, no nested duplicates.

Notes

• mcp-server/ (not covered by CI) has neither package in its lockfile — verified, untouched.
• next/dist/compiled/nanoid is a vendored copy inside Next's prebuilt output. It isn't a lockfile entry, isn't in the dependency graph Dependabot scans, and can't be reached by overrides; it clears only when Next itself rebuilds against a patched nanoid.

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project crxylxakpapcfziradbb because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.