fix: update nanoid to resolve CVE-2026-67213

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

• Dependency: nanoid bumped 3.3.16 -> 3.3.18 (transitive, via postcss -> @tailwindcss/postcss)
• Advisory: GHSA-2v37-7h3g-55p8 / https://nvd.nist.gov/vuln/detail/CVE-2026-67213
• Dependabot alert: https://github.com/warpdotdev/do-things/security/dependabot/36
• Verification: npm audit no longer flags nanoid; npm run build succeeds (Next.js build + type check + lint pass)

Highlight the risky code / where the dependency was used

nanoid isn't a direct dependency — it's pulled in transitively by postcss (used by @tailwindcss/postcss). No app code references it directly, so no compatibility impact expected.

Special instructions for this PR

None.

AFTER YOU MERGE

None.

Co-Authored-By: Warp agent@warp.dev

[independabot-soc2]

Closing as duplicate — this same nanoid 3.3.18 fix (CVE-2026-67213 / GHSA-2v37-7h3g-55p8) is already covered by #27.