fix(security): upgrade nanoid to 5.1.16 (BLO-23043)

[allyblockcast]

Thinking Path

• Dependabot alert fix(heartbeat): require silence floor before reaping when Job missing from kube snapshot (BLO-6843) #143 reports nanoid >=4.0.0, <5.1.16 as vulnerable to GHSA-28wg-ghj8-5hjv / CVE-2026-67214.
• Root pnpm overrides centrally constrain transitive versions, and this App-authored PR is exempt from the repository's manual-lockfile guard.
• PR fix(security): upgrade nanoid to 5.1.16 (BLO-23043) #1218 accumulated transient App-authored lockfile/revert commits while resolving review feedback, which violates the independent-author policy.
• This policy-clean successor starts from fix(security): upgrade nanoid to 5.1.16 (BLO-23043) #1218's original human-authored remediation, adds the reviewed full-range regression fix, and commits the regenerated lockfile requested by current-head review.

Linked Issues or Issue Description

• Fixes BLO-23043.
• Supersedes fix(security): upgrade nanoid to 5.1.16 (BLO-23043) #1218 without carrying its transient App-authored commits.
• Advisory: GHSA-28wg-ghj8-5hjv / CVE-2026-67214.

What Changed

• Added a workspace-wide nanoid >=5.1.16 <6 pnpm override.
• Added a regression covering every stable vulnerable 4.x, 5.0.x, and 5.1.0-5.1.15 lockfile key.
• Regenerated and committed pnpm-lock.yaml; all affected paths now resolve nanoid@5.1.16.

Verification

• pnpm 9.15.4 install --lockfile-only --ignore-scripts --no-frozen-lockfile passed.
• pnpm 9.15.4 install --frozen-lockfile --ignore-scripts passed.
• pnpm --filter @paperclipai/server exec vitest run src/__tests__/security-audit-overrides.test.ts --reporter=verbose passed: 3 tests.
• Committed lockfile resolves only nanoid@5.1.16 for affected paths.

Risks

• Low risk: this is a narrow transitive override bounded to nanoid v5 plus a focused regression.
• No API, UI, schema, or migration changes.

Model Used

• OpenAI GPT-5.6-sol, tool-enabled coding agent with repository inspection and local test execution.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used with available version and capability details
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have linked the existing Paperclip issue
• I have run focused tests locally and they pass
• I have added or updated tests where applicable
• This change does not affect the UI, so screenshots are not applicable
• Relevant documentation remains accurate
• I have considered and documented risks
• All Paperclip CI gates are green
• Ally review has no open findings

[allyblockcast]

🔗 Paperclip issue: BLO-23043

[allyblockcast]

🔗 Paperclip issue: BLO-23043

[allyblockcast]

Hey @allyblockcast[bot]! Before this PR can be reviewed, a few things need attention:

Missing or incomplete:

• Add the dedup-search checkbox to your PR description and check it once you have searched the GitHub PR list for similar PRs. See the PR template at .github/PULL_REQUEST_TEMPLATE.md and CONTRIBUTING.md → "Before You Start: Search First".

Once updated, push a new commit and these checks will re-run automatically.

— commitperclip

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 2554967

Critical Issues (0)

Important Issues (1)

• [code, tests, native-codex] package.json:155 — The override is not reflected in pnpm-lock.yaml, which still pins the affected paths to nanoid@5.1.11 (pnpm-lock.yaml:8735, pnpm-lock.yaml:8758, and pnpm-lock.yaml:12864). The security remediation is therefore not present in the committed install graph, and the new assertion at security-audit-overrides.test.ts:35 fails because the lockfile has no nanoid@5.1.16 entry.
  • Regenerate and commit pnpm-lock.yaml after adding the override, ensuring all affected resolutions use nanoid@5.1.16 or later, then run the security-audit overrides test.

Suggestions (0)

Strengths

• The override range correctly excludes the advisory's vulnerable 5.1.x releases.
• The added regression test validates both the configured constraint and the resolved dependency graph.

Recommended Action

1. Address the Important issue this cycle before merging.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: c7b2b3f

Prior Findings Dispositioned (1)

• prior:2554967 important 1 — still-present — pnpm-lock.yaml:7042 — The exact-head lockfile still resolves nanoid@5.1.11; no nanoid@5.1.16 package entry is present.

Critical Issues (0)

Important Issues (1)

• [prior:2554967 important 1; pr-review-toolkit, gstack/review, native-codex] pnpm-lock.yaml:7042 — The committed install graph remains on vulnerable nanoid@5.1.11, despite the new package override. The new test at server/src/__tests__/security-audit-overrides.test.ts:61 requires nanoid@5.1.16, so it will fail and the security remediation is not delivered.
  • Regenerate and commit pnpm-lock.yaml, ensuring affected resolutions use nanoid@5.1.16 or later, then run the security-audit overrides test.

Suggestions (0)

Strengths

• The override range correctly targets the patched nanoid release line.
• The regression assertion checks both the declared override and the resolved lockfile state.

Recommended Action

1. Address the Important issue before merge.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 2fed416

Prior Findings Dispositioned (1)

• prior:2554967 important 1 — fixed — pnpm-lock.yaml:7038 — The exact-head lockfile now declares nanoid@5.1.16, and its consumer snapshots resolve the package at pnpm-lock.yaml:8728, pnpm-lock.yaml:8751, pnpm-lock.yaml:12857, and pnpm-lock.yaml:15503.

Critical Issues (0)

Important Issues (0)

Suggestions (0)

Strengths

• The override and regenerated lockfile consistently resolve the patched nanoid release.
• The regression test validates both the declared override and the resolved lockfile graph.

Recommended Action

1. Ready to merge from this review's perspective.

[kkroo]

Superseded by #1228, the independently authored kkroo successor at cfddde08337c2b236203c2a42f879780554b84b0.

#1228 preserves the remediation while respecting the repository rule that human/agent PRs do not commit pnpm-lock.yaml; its regression validates the disposable policy-generated lockfile artifact instead. Closing this App-authored duplicate rather than merging it.