From 89b16b97d17115d44d9818cd70853e135176b247 Mon Sep 17 00:00:00 2001
From: Anso <dev@saelix.com>
Date: Fri, 7 Aug 2026 20:14:24 -0400
Subject: [PATCH] chore: bump nanoid via npm audit fix (#1795)

Resolves GHSA-2v37-7h3g-55p8 (nanoid custom generators can loop
indefinitely when size is zero), a newly published advisory for
nanoid <3.3.17. Transitive dev dependency of postcss (via vite)
in both packages:
- backend: nanoid 3.3.16 -> 3.3.18
- frontend: nanoid 3.3.16 -> 3.3.18

npm audit --audit-level=high now passes clean on both packages.
---
 backend/package-lock.json  | 8 ++++----
 frontend/package-lock.json | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/backend/package-lock.json b/backend/package-lock.json
index 0953838f..85ca6d04 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -10,7 +10,6 @@
       "hasInstallScript": true,
       "license": "AGPL-3.0-only",
       "dependencies": {
-        "@aws-sdk/client-s3": "3.1101.0",
         "axios": "^1.15.0",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^13.0.1",
@@ -2413,6 +2412,7 @@
       "version": "13.0.2",
       "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-13.0.2.tgz",
       "integrity": "sha512-jW6oufeDhXZaiX9Lw5A+oerVClx4iFrI6uDj1zu7SqUAjak9vbJvA0NEcKLNxHiQHb6kYCoFzzXYV0YOauhV3g==",
+      "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
         "node-addon-api": "^8.0.0"
@@ -5081,9 +5081,9 @@
       "optional": true
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 83efd8f0..afebdddc 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -6839,9 +6839,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "dev": true,
       "funding": [
         {