fix(web-ui): bump transitive nanoid to 3.3.18, patches CVE-2026-67213

[jamesarich]

Summary

Patches Dependabot alert #24 (GHSA-2v37-7h3g-55p8 / CVE-2026-67213, high severity): nanoid < 3.3.18 has an infinite loop in customAlphabet/customRandom when called with size=0. Pulled in transitively by postcss (^3.3.16, already satisfied by 3.3.18) — lockfile-only change, no package.json edits needed.

Test plan

npm update nanoid && npm run build in web-ui/ — build succeeds, output unchanged in shape (gitignored src/meshtastic_mcp/web/static/). Not exploitable in this codebase today (postcss doesn't pass attacker-controlled size to nanoid), but zero-risk patch bump, worth taking regardless.

Checklist

• Gates pass — n/a (pure lockfile bump, no Python changes; npm run build verified)
• New MCP tools have read/destructive/openWorld annotations — n/a
• Core changes import/run with no firmware checkout — n/a
• DCO sign-off (git commit -s)

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• web-ui/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 39ad6bc1-a5e6-4a32-a1f1-38b01b1ee7bd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}