[CSR-0] chore: Bump nanoid from 3.3.17 to 6.0.0 in /packages/cmd

[dependabot]

Bumps nanoid from 3.3.17 to 6.0.0.

Release notes

Sourced from nanoid's releases.

6.0.0

• Made nanoid() and customAlphabet() 4 times faster (by @​orhanayd).
• Removed Node.js 18 and 20 support.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking nanoid by requesting big ID (by @​alanzabihi).

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

5.1.6

• Fixed infinite loop on 0 size for customAlphabet.

5.1.5

• Fixed latest version on npm after 3.x release.

5.1.4

• Fixed latest version on npm after 3.x release.

5.1.3

• Fixed React Native support (by @​steida).

5.1.2

... (truncated)

Changelog

Sourced from nanoid's changelog.

6.0.0

• Made nanoid() and customAlphabet() 4 times faster (by @​orhanayd).
• Removed Node.js 18 and 20 support.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

5.1.6

... (truncated)

Commits

• 4dacb10 Release 6.0.0 version
• 09545ea Simplify CLI for modern Node.js
• 0966ccb Remove obvious comment
• b5a0590 Update docs
• 0501d9c Fix alphabet duplication
• 87f2821 Remove unnecessary import for modern Node.js
• 6a73bf8 Simplfy strings
• 57a250c Simplify code
• 1a97659 Fix formatting
• 1fda937 Remove build files
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: ynahmany. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[maxigimenez]

Security triage — Tier B, and this one is incomplete as written.

Same target as #399: nanoid → ^6.0.0 in packages/cmd, aimed at GHSA-2v37-7h3g-55p8 (HIGH, <3.3.18, patched 3.3.18) — Dependabot alert 178, Vanta remediateByDate 2026-09-16, 22 days from today.

Two problems

1. The manifest moves without the lockfile.

$ git diff main..this-branch --stat
 packages/cmd/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

package-lock.json is untouched, so packages/cmd would declare ^6.0.0 while the lockfile still resolves nanoid to 3.3.16. npm ci fails outright when the manifest and lockfile disagree, which would break every workflow in this repo — all three run npm ci. #399 makes the same manifest edit and regenerates the lockfile.

2. It would not close the alert even with the lockfile regenerated.

postcss requests nanoid@^3.3.16 independently of packages/cmd. On #399's regenerated lockfile the vulnerable 3.3.16 is still present at the root serving postcss, with 6.0.0 nested under packages/cmd. Editing packages/cmd's range does not remove the version the advisory names.

The fix that does work

^3.3.8 (packages/cmd) and ^3.3.16 (postcss) both already admit 3.3.18, so no manifest edit is required. Verified on main:

$ npm update nanoid
$ git diff --name-only
package-lock.json
# -> single copy at 3.3.18; npm audit: nanoid entry gone

Also relevant to the major itself: nanoid 6.0.0 removes Node.js 18 and 20 support, while @currents/jest and @currents/node-test-reporter declare "engines": { "node": ">=18.20.4" } and types-matrix.yml type-checks on Node 18.

Verification

step	result
branch state	merge-base 79293ca = current main, 0 conflicts, not behind
changed files	packages/cmd/package.json only — no lockfile
CI	no check runs attached to head 74758113; nothing has run

What a human should decide

Recommended: close this as superseded — it is a strict subset of #399 and cannot be merged as-is. Then close alert 178 with a npm update nanoid lockfile refresh rather than either PR. I have not closed it; that is the author's call.

---

Generated by Claude Code

[twk3]

@dependabot ignore this major version

[dependabot]

OK, I won't notify you about version 6.x.x again, unless you re-open this PR.