High-severity nanoid advisory in the production tree (via vite → postcss), on both branches #2058

npm audit --omit=dev at the repo root reports one high severity vulnerability in the production tree, on both main and v2/main (identical version, so it is not drift — see #2057, which is about parity and deliberately leaves this alone):

nanoid  3.3.16   severity=high   vulnerable: <3.3.18   fixAvailable: true
GHSA-2v37-7h3g-55p8 — custom generators can loop indefinitely when size is zero

It is transitive, three levels down:

@modelcontextprotocol/inspector
└─┬ vite@8.2.0
  └─┬ postcss@8.5.25
    └── nanoid@3.3.16

Dependabot has not raised it — plausibly because the advisory is only reachable through a postcss range that its security updates consider already satisfied, or because it is grouped with updates it has open elsewhere. Worth confirming rather than assuming.

Notes

• npm audit fix reports a fix is available, so this is likely a lockfile-only bump of nanoid (or of postcss), not a vite major.
• Reachability is probably nil in practice — the affected path needs a custom generator called with size: 0, and nothing here calls nanoid directly; it arrives through PostCSS's source-map machinery. That argues for treating this as hygiene rather than an incident, but the audit output is a standing red mark on the release branch either way, and a clean npm audit is worth having so a real finding is not lost in noise.
• Note vite is declared in root dependencies, not devDependencies, which is why this shows under --omit=dev at all. Whether that placement is correct is a separate question worth a look while here — per the placement rule in AGENTS.md, a package only the build tooling needs belongs in devDependencies.

Scope

Bump the transitive dependency to a non-vulnerable version, confirm npm audit --omit=dev is clean at the root and in each client install, and run npm run ci.