[Chore] Resolve nanoid security alert

[roomote-roomote]

​Opened on behalf of @mrubens. View the task or mention @roomote for follow-up asks.

What changed

• Resolve transitive nanoid versions below 4 to the existing 5.1.16 release.
• Remove the obsolete nanoid 3.3.17 entries from the lockfile.

Why this change was made

Dependabot alert #98 covers an infinite-loop condition in older nanoid releases. The separate image-size remediation was removed from this pull request after review.

Impact

There is no intended product behavior change. The dependency graph now resolves PostCSS's older nanoid requirement to 5.1.16, while Storybook and image-size remain unchanged from develop.

[roomote-community]

No code issues found. See task

_{Reviewed 8d6dbf4}

[mrubens]

@roomote is it really worth breaking this if it's not being used? Is it not going to be fixed?

[roomote-community]

I'm on it. I started a dedicated PR follow-up task for this request, and I'll keep updates here. See task

[roomote-community]

You’re right to question it. This does not break a current Roomote path: I rechecked apps/web and there are no static image imports for Storybook to process. But it does deliberately turn that currently-unused capability into a future build failure, so this is containment rather than a real fix.

There is still no patched image-size release (2.0.2 remains latest, and both advisories list no fixed version). The stub also will not remove itself, and this PR does not currently add tracking for that cleanup. Given that the affected path is build-time and processes repository-owned images, the practical exposure is low. I would either keep the dependency and document/accept that risk for now, or keep the stub only with an explicit follow-up to remove it as soon as upstream patches it; we should not present the stub as permanently fixing the capability.

[mrubens]

@roomote can you remove the parts of this related to image-size then?

[roomote-community]

I'm on it. I started a dedicated PR follow-up task for this request, and I'll keep updates here. See task

[roomote-community]

Removed all image-size and Storybook-related changes from this PR; the final diff now contains only the nanoid remediation. Validation and pre-push checks passed in commit 8d6dbf44. See task · Revert