fix(security): patch transitive nanoid advisory

.github/workflows/release.yml

@@ -14,6 +14,8 @@ jobs:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 10.27.0

CHANGELOG.md

@@ -31,6 +31,10 @@ No unreleased changes.
 
 ### Release and verification
 
+- Pinned the transitive build-time `nanoid` 3.x line to `3.3.18`, the first
+  patched release for CVE-2026-67213 / GHSA-2v37-7h3g-55p8. The affected path
+  is confined to Vite/PostCSS development tooling and is not a runtime
+  dependency of any published `@bidilens/*` package.
 - Pinned the supported CI runtimes to exact Node 22.12.0 and 24.15.0 releases
   so the documented minimum is exercised instead of silently floating to the
   newest release in each major line.

package.json

@@ -88,7 +88,7 @@
       "fast-uri": "3.1.5",
       "js-yaml@3": "3.15.1",
       "js-yaml@4": "4.3.1",
-      "nanoid": "3.3.17",
+      "nanoid": "3.3.18",
       "postcss": "8.5.23",
       "undici": "7.29.0"
     }