fix: update vulnerable packages to fixed releases

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Security fix for High dependency advisories.

Packages

• nanoid 3.3.12 -> 3.3.18. This fixes GHSA-2v37-7h3g-55p8 (CVE-2026-67213) and GHSA-28wg-ghj8-5hjv (CVE-2026-67214).
• sharp 0.35.4 -> 0.35.5. This fixes GHSA-wq5f-xc86-pv6w (CVE-2026-96889). Wrangler 4.149.0 selects this release.
• source-map-js 1.2.1 -> 1.2.2. This fixes GHSA-68fv-2mgg-jv7q (CVE-2026-93749).
• vite 7.3.1 -> 7.3.5. This fixes GHSA-p9ff-h696-f583 (CVE-2026-39363), GHSA-v2wj-q39q-566r (CVE-2026-39364), and GHSA-fx2h-pf6j-xcff (CVE-2026-53571).
• postcss 8.5.14 -> 8.5.18. This fixes GHSA-r28c-9q8g-f849 (CVE-2026-73646).

Each release is older than the seven-day cooldown. This change does not add a minimumReleaseAgeExclude entry.

Left on the current release

Each listed package has a patched release. Two later advisories are Moderate, so this change keeps the nearest High fix.

• PostCSS GHSA-fxqj-rqcc-2cmp is Moderate. Release 8.5.23 contains that fix.
• Vite GHSA-rq7h-c2jc-7f22 is Moderate. Release 7.3.7 contains that fix.

Test audit

This pull request does not add, change, or delete a test. The existing suite protects the public package behavior.

Verification

• pnpm install passed the supply-chain policy.
• pnpm build passed.
• node scripts/test-build.mjs passed.
• pnpm test:ci passed.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T23:11:06.769607Z	77010ef	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	wrangler@​4.143.0 ⏵ 4.149.0			+1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f885a2e) to head (77010ef).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1745   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           29        29           
  Lines         3620      3620           
  Branches       810       825   +15     
=========================================
  Hits          3620      3620           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.