vuln: override nanoid to 3.3.8

5.0.9 is ESM and PostCSS expects to be able to require() nanoid

Author: zachstence

.changeset/new-tigers-confess.md

@@ -3,4 +3,4 @@
 '@evidence-dev/core-components': patch
 ---
 
-Override nanoid to >=5.0.9
+Override nanoid to 3.3.8

package.json

@@ -49,7 +49,7 @@
 		"get-port": "^7.1.0",
 		"git-remote-origin-url": "4.0.0",
 		"http-proxy": "^1.18.1",
-		"nanoid": "^5.0.9",
+		"nanoid": "3.3.8",
 		"node-fetch": "^3.3.2",
 		"npm-run-all": "^4.1.5",
 		"open": "^9.1.0",
@@ -111,7 +111,7 @@
 			"fast-xml-parser": ">=4.4.1",
 			"dset": ">=3.1.4",
 			"cookie": ">=0.7.1",
-			"nanoid": ">=5.0.9"
+			"nanoid": "3.3.8"
 		}
 	},
 	"packageManager": "pnpm@8.15.9+sha512.499434c9d8fdd1a2794ebf4552b3b25c0a633abcee5bb15e7b5de90f32f47b513aca98cd5cfd001c31f0db454bc3804edccd578501e4ca293a6816166bbd9f81"

packages/lib/sdk/package.json

@@ -124,7 +124,7 @@
 		"lodash.chunk": "^4.2.0",
 		"lodash.merge": "^4.6.2",
 		"mdsvex": "^0.11.0",
-		"nanoid": "^5.0.9",
+		"nanoid": "3.3.8",
 		"ora": "^8.0.1",
 		"perfect-debounce": "^1.0.0",
 		"pkg-types": "^1.0.3",
@@ -152,7 +152,7 @@
 	},
 	"peerDependencies": {
 		"@evidence-dev/universal-sql": "workspace:*",
-		"nanoid": "^5.0.9",
+		"nanoid": "3.3.8",
 		"perfect-debounce": "^1.0.0",
 		"svelte": "^4.2.19"
 	},

packages/ui/core-components/package.json

@@ -60,7 +60,7 @@
 		"export-to-csv": "0.2.1",
 		"leaflet": "^1.9.4",
 		"lodash": "^4.17.21",
-		"nanoid": "^5.0.9",
+		"nanoid": "3.3.8",
 		"perfect-debounce": "^1.0.0",
 		"prismjs": "1.29.0",
 		"ssf": "0.11.2",