fix(deps): patch nanoid and brace-expansion advisories

[chaliy]

What changed

Clears the three open high-severity npm advisories in the repo's JavaScript
dependency trees. No runtime or API behavior changes — both fixes are
backported within the existing major, so this is a patch-level bump of
transitive dependencies plus the overrides that pin them.

• site/ — new nanoid ^3.3.17 override (3.3.16 → 3.3.18, via postcss)
• examples/browser/ — new pnpm.overrides block with nanoid ^3.3.17
  (3.3.16 → 3.3.18, via postcss)
• crates/bashkit-js/ — brace-expansion override ^2.1.2 → ^2.1.4
  (2.1.2 → 2.1.4, via minimatch)

Lockfiles were refreshed with each project's pinned pnpm (10.11.1 for site,
10.33.0 for bashkit-js and examples/browser); all remain at
lockfileVersion 9.0.

Why

pnpm audit reported three high-severity transitive advisories that no open
Dependabot PR covered:

Advisory	Package	Vulnerable	Patched	Reaches
CVE-2026-67213	nanoid	< 3.3.17	3.3.18	site, examples/browser (postcss)
CVE-2026-14257	brace-expansion	>= 2.0.0 < 2.1.3	2.1.4	crates/bashkit-js (minimatch)
CVE-2026-69152	brace-expansion	>= 2.0.0 < 2.1.4	2.1.4	crates/bashkit-js (minimatch)

nanoid: custom generators can loop indefinitely when size is non-integer.
brace-expansion: DoS via unbounded expansion length and unbounded intermediate
arrays (the second bypasses the first fix, hence 2.1.4 rather than 2.1.3).

Follows the override pattern established by #2284 (js-yaml).

Before / After

pnpm audit per package, before:

site               high 1   nanoid 3.3.16            CVE-2026-67213
crates/bashkit-js  high 2   brace-expansion 2.1.2    CVE-2026-14257, CVE-2026-69152
examples           clean
examples/browser   high 1   nanoid 3.3.16            CVE-2026-67213
examples/bashkit-pi clean

After:

site                {'info': 0, 'low': 0, 'moderate': 0, 'high': 0, 'critical': 0}
crates/bashkit-js   {'info': 0, 'low': 0, 'moderate': 0, 'high': 0, 'critical': 0}
examples            {'info': 0, 'low': 0, 'moderate': 0, 'high': 0, 'critical': 0}
examples/browser    {'info': 0, 'low': 0, 'moderate': 0, 'high': 0, 'critical': 0}
examples/bashkit-pi {'info': 0, 'low': 0, 'moderate': 0, 'high': 0, 'critical': 0}

Verified locally:

• pnpm install --frozen-lockfile passes in all three touched projects (this is
  what CI runs, so the refreshed lockfiles are consistent with the manifests).
• site: pnpm run build completes — 40 pages built, and all 10 postbuild
  verifiers pass (doc routes, sitemap, robots, link headers, meta descriptions,
  llms.txt).
• examples/browser: vite build succeeds and node --test passes 9/9,
  including the "dependencies are reproducible" lockfile check.
• Rust side unaffected and independently clean: cargo audit reports 0
  vulnerabilities over 633 crates (only the 3 pre-existing allowed warnings —
  RUSTSEC-2023-0089, RUSTSEC-2026-0173, and yanked spin 0.9.8).

crates/bashkit-js type-check is left to CI, since it requires a full native
NAPI build and brace-expansion only reaches dev tooling via minimatch.

Risk

• Low
• Both bumps are patch releases within the existing major of transitive
  dependencies, reached only through postcss and minimatch. The plausible
  failure mode is a lockfile inconsistency breaking --frozen-lockfile in CI,
  which was checked directly in all three projects.

Checklist

• Tests added or updated — no new tests; existing examples/browser
  reproducibility test and the site postbuild verifiers cover the change
• Backward compatibility considered — no API or behavior change

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	e3fcc16	Commit Preview URL Branch Preview URL	Aug 09 2026, 09:17 AM