chore(deps): update dependency nanoid to v5.1.11

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid	5.1.6 → 5.1.11

---

Release Notes

ai/nanoid (nanoid)

v5.1.11

Compare Source

• Fixed breaking Nano ID by requesting big ID.

v5.1.10

Compare Source

• Fixed breaking nanoid by requesting big ID (by @​alanzabihi).

v5.1.9

Compare Source

• Fixed npm package size regression.

v5.1.8

Compare Source

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

v5.1.7

Compare Source

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[cursor]

Stale comment

Security Review: No Issues Found

This PR updates the nanoid dev dependency from 5.1.6 to 5.1.9 in web/package-lock.json only. No security concerns identified:

• Scope: Lockfile-only change; no application code modified.
• Dependency risk: nanoid is a dev-only dependency (not shipped to production). No known vulnerabilities exist for the 5.1.x line (prior issues like CVE-2024-55565 were fixed in 5.0.9).
• Supply chain: Integrity hashes are present and the package is resolved from the official npm registry. The update is authored by Renovate Bot, a trusted automated dependency manager.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review (nanoid 5.1.6 → 5.1.9)

Outcome: No medium, high, or critical findings tied to this change.

What changed: Only web/package-lock.json — resolved version and integrity hash for the top-level nanoid devDependency (5.1.6 → 5.1.9). No application or build-script source was modified.

Analysis:

• Attack surface: No new code paths; dependency patch bump only.
• Direct usage: No import/require of nanoid in web/ Vue/JS sources; it remains a dev dependency (lockfile marks node_modules/nanoid as dev: true).
• Known nanoid issues: CVE-2024-55565 (fractional size / DoS) is fixed in 5.0.9+; both old and new versions are in the patched range. Public scanners (e.g. Snyk) list no direct vulnerabilities on 5.1.9.
• Supply chain: Same registry URL pattern; integrity pin updated to match the new tarball — expected for a lockfile update.

No inline comments filed; nothing to substantiate at medium+ confidence with a concrete exploit path in this diff.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review (nanoid 5.1.6 → 5.1.11)

Scope: Only web/package-lock.json changed (version + npm integrity for nanoid).

Assessment: No medium, high, or critical issues identified from this diff.

• No application or config logic was added or modified; there is no new attacker-controlled sink or boundary change to analyze.
• This is a patch-level bump within the existing 5.x line. Known advisory CVE-2024-55565 (fractional size / improper validation) affects versions < 5.0.9; 5.1.6 and 5.1.11 are already in the fixed range, so the bump does not remediate a gap introduced by this PR—it maintains dependency hygiene.
• Supply-chain: updated tarball is pinned with an npm integrity hash in the lockfile (standard npm verification).

Prior threads: Previous automation assessments were cleared so this review reflects the current state only.

No inline comments: no high-confidence vulnerability tied to the modified lines.

  

_{Sent by Cursor Automation: Find vulnerabilities}