Update dependencies to fix security vulnerabilities

[ghost-of-high-heart]

This pull request automatically updates dependencies to resolve known security vulnerabilities.

Warning

The following vulnerable packages have fixes available, but they have not met the minimumReleaseAge requirement yet and were skipped:

• nanoid (3.3.18): available in 8 days
• nanoid (6.0.1): available in 4 days
• postcss (8.5.26): available in 7 days

---

Caution

The following packages are still vulnerable because no safe update could be applied (either no patch exists, or it was blocked by policy, or pnpm dedupe couldn't resolve the constraint tree):

• adm-zip: adm-zip: Crafted ZIP file triggers 4GB memory allocation
• nanoid: nanoid: custom generators can loop indefinitely when size is zero
• postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output, PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments, PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure, PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset
• sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

---

nanoid

3.3.12 -> 3.3.16

Resolved advisories:

• GHSA-28wg-ghj8-5hjv - nanoid: non-secure generators can loop indefinitely with negative size

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
swiss-maps	Ready	Preview	Aug 14, 2026 4:43pm