chore(security): fix nanoid, postcss, unhead advisories in ui/package-lock.json

[benfrank241]

Daily security sweep — ui/ npm bundle.

Fixes 4 of the 6 advisories npm audit reports for ui/package-lock.json. Lockfile-only: ui/package.json is unchanged. All three packages had a fixed version already inside the ranges the existing manifest declares, so no direct bump and no overrides entry was needed.

Advisories fixed

package	direct/transitive	before	after	GHSA
nanoid	transitive (via postcss)	3.3.11	3.3.18	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
postcss	transitive (via vite)	8.5.8	8.5.26	GHSA-qx2v-qp2m-jg93, GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
unhead	transitive (pinned exactly by @unhead/vue)	2.1.12	2.1.17	GHSA-95h2-gj7x-gx9w
@unhead/vue	direct (^2.1.12)	2.1.12	2.1.17	— (flagged for depending on vulnerable unhead)

3 high (nanoid, postcss) and 1 moderate (unhead / @unhead/vue) resolved. hookable 6.1.0 → 6.1.1 comes along as @unhead/vue's own in-range dependency.

Why no manifest change was needed:

• postcss 8.5.26 satisfies vite@5.4.21's declared postcss: ^8.4.43.
• nanoid 3.3.18 satisfies postcss@8.5.26's declared nanoid: ^3.3.17.
• @unhead/vue 2.1.17 satisfies the manifest's declared ^2.1.12, and @unhead/vue pins unhead exactly, so unhead moves with it.

Not fixed here — vite / esbuild (deliberately excluded)

npm audit's only offered fix for this pair is npm audit fix --force, which installs vite@8.2.2 — three major versions up. This sweep does not force resolves, so the pair is left alone and tracked in #39 instead:

• esbuild <= 0.24.2 — GHSA-67mh-4wv8-2f99 (moderate)
• vite <= 6.4.2 — GHSA-fx2h-pf6j-xcff (high), GHSA-4w7w-66w2-5vf9 (moderate), GHSA-v6wh-96g9-6wx3 (moderate)

There is no in-range fix: vite 5.x tops out at 5.4.21 (what is installed) and the whole 5.x line stays inside the vulnerable range, so escaping it is necessarily a major bump. See #39 for the analysis — the minimal escape is vite@^6.4.3, not the 8.2.2 npm suggests.

About the @tailwindcss/oxide-wasm32-wasi block in the diff

58 of the 75 added lines are six inBundle: true, optional: true entries under node_modules/@tailwindcss/oxide-wasm32-wasi/. These are not part of the security change. They are npm 10.9.8 renormalizing bundled optional dependencies, and running a no-op npm install --package-lock-only on untouched main produces the exact same 58 lines. They carry no resolved/integrity, so they add no new downloads. Verified before committing so the churn could be accounted for rather than hidden.

Verification — local only

This repository has no CI. There is no .github/workflows directory at all, so nothing will run against this branch. Everything below was run locally on the branch, and the same steps were run first on untouched main to establish a baseline. ui/package.json defines only dev / build / preview — there is no test and no lint script, so those steps do not exist here.

step	main (baseline)	this branch
npm ci	exit 0 — 56 packages	exit 0
npm run build (vite build)	exit 0 — 71 modules, built in 751 ms	exit 0 — 71 modules, built in 769 ms
npm audit --package-lock-only	6 vulns (3 high, 3 moderate)	2 vulns (1 high, 1 moderate)

The baseline was already green, so this is a true pass rather than a differential comparison. Module count is identical (71 → 71); the CSS chunk hash is unchanged and the JS chunk moves 226.71 kB → 227.42 kB, consistent with the unhead patch bump.

Node v22.22.3, npm 10.9.8, macOS arm64.

Built ui/dist/ is checked into this repo. It was deliberately not regenerated here — this PR touches ui/package-lock.json and nothing else, so the committed dist/ is left exactly as it is on main.

---

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
memory-bench	Ready	Preview	Sep 1, 2026 2:22pm UTC
open-memory-benchmark	Ready	Preview	Sep 1, 2026 2:22pm UTC