fix: bump nanoid to ^5.1.16 and vitest to ^4.1.11 (dependency vulnerabilities)

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-12 (first opened 2026-09-28).
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
nanoid (packages/web-extension)	npm	Major	^4.0.0 → ^5.1.16	High	123d	Dependabot, Wiz	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w, GHSA-mwcw-c2x4-8c55 / CVE-2024-55565 (Dependabot #93–#96)
vitest (11 workspace packages)	npm	Major	^3.2.6 → ^4.1.11	Medium	32d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9 (Dependabot #97–#107)

Notes for reviewers:

• The repo has no committed lockfile (/yarn.lock is gitignored and the lockfile is owned by launchdarkly/observability-sdk), so this PR only changes manifests. A fresh install resolves nanoid 5.1.16 and vitest 4.1.11. vite stays on ^6.4.2, since vitest 4.1.11 supports vite 6, 7 and 8.
• nanoid 5 is ESM-only. web-extension only uses the named nanoid export in ESM/Vite code, and the extension builds.
• Overlaps with Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 on the nanoid line. That PR sets ^5.1.11, which leaves the manifest floor inside alert #95's vulnerable range (< 5.1.16). Whichever PR merges second needs a trivial conflict fix.
• Supersedes the vitest part of Dependabot chore(deps-dev): bump the npm_and_yarn group across 2 directories with 1 update #33. That PR targets ^4.1.8, which is still inside the < 4.1.11 vulnerable range, and it also bumps vite to 8.
• vitest.workspace.ts uses defineWorkspace, which vitest 4 removed. No script references the file, because each package runs its own vitest.config.ts via turbo, so it was left untouched.
• 2026-10-12: merged main (fix(record): resync replaces grown sheets instead of re-sending the tail #42, stylesheet resync fix). No new findings for this group.

Deferred / excluded findings

• Covered by open Dependabot PR: svelte (packages/rrweb-player) ^4.2.14 → 5.55.7, Medium, 234d (Dependabot #52–#55, #75, #76; GHSA-crpf-4hrx-3jrp, GHSA-f7gr-6p89-r883, GHSA-m56q-vw4c-c2cp, GHSA-phwv-c562-gvmh, GHSA-pr6f-5x2q-rwfp, GHSA-rcqx-6q8c-2c42). Fully fixed by Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 (^5.56.3).
• Major that needs a source change, so it has its own PR: react-router (packages/web-extension, via react-router-dom) 6.30.6 → 7.18.4, Medium, Wiz only (CVE-2026-53666, CVE-2026-53669). See fix: bump react-router-dom to ^7.18.0 in web-extension (dependency vulnerabilities) #41.

Verification

Re-checked on 2026-10-12 after merging main:

• Install: ✅ yarn install resolves nanoid 5.1.16 and vitest 4.1.11. The only failure is packages/rrvideo's Playwright browser postinstall, which can't reach the Playwright CDN from the automation sandbox. This happens on main too.
• Build: ✅ rrweb and its workspace dependencies build. The full yarn build:all passed 22/22 on 2026-10-05.
• Tests: ✅ The test main added in fix(record): resync replaces grown sheets instead of re-sending the tail #42 (packages/rrweb/test/record/stylesheet-resync.test.ts) passes 9/9 on vitest 4.1.11. The full suite runs in CI (Tests, WebKit (Safari engine) tests).
• Lint: ✅ yarn lint had no new errors on 2026-10-05. The only errors are the same 3 rrweb-player .svelte parser errors as on main. CI ESLint runs on this head.

Link to Devin session: https://app.devin.ai/sessions/68b2679b5727400b96785aa77f9ca237
Open in Devin Desktop: https://app.devin.ai/desktop/session/68b2679b5727400b96785aa77f9ca237?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring