fix: bump nanoid to ^5.1.16 and vitest to ^4.1.11 (dependency vulnerabilities)

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-05 (first opened 2026-09-28).
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
nanoid (packages/web-extension)	npm	Major	^4.0.0 → ^5.1.16	High	116d	Dependabot, Wiz	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w, GHSA-mwcw-c2x4-8c55 / CVE-2024-55565 (Dependabot #93–#96)
vitest (11 workspace packages)	npm	Major	^3.2.6 → ^4.1.11	Medium	25d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9 (Dependabot #97–#107)

Notes for reviewers:

• The repo has no committed lockfile (/yarn.lock is gitignored and the lockfile is owned by launchdarkly/observability-sdk), so this PR only changes manifests. A fresh install resolves nanoid 5.1.16 and vitest 4.1.11. vite stays on ^6.4.2, since vitest 4.1.11 supports vite 6, 7 and 8.
• nanoid 5 is ESM-only. web-extension only uses the named nanoid export in ESM/Vite code, and the extension builds.
• Overlaps with Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 on the nanoid line. That PR sets ^5.1.11, which leaves the manifest floor inside alert #95's vulnerable range (< 5.1.16). Whichever PR merges second needs a trivial conflict fix.
• Supersedes the vitest part of Dependabot chore(deps-dev): bump the npm_and_yarn group across 2 directories with 1 update #33. That PR targets ^4.1.8, which is still inside the < 4.1.11 vulnerable range, and it also bumps vite to 8.
• vitest.workspace.ts uses defineWorkspace, which vitest 4 removed. No script references the file, because each package runs its own vitest.config.ts via turbo, so it was left untouched.
• Re-checked 2026-10-05: the branch is 0 commits behind main, so no new commits were needed.

Deferred / excluded findings

• Covered by open Dependabot PR: svelte (packages/rrweb-player) ^4.2.14 → 5.55.7, Medium, 227d (Dependabot #52–#55, #75, #76; GHSA-crpf-4hrx-3jrp, GHSA-f7gr-6p89-r883, GHSA-m56q-vw4c-c2cp, GHSA-phwv-c562-gvmh, GHSA-pr6f-5x2q-rwfp, GHSA-rcqx-6q8c-2c42). Fully fixed by Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 (^5.56.3), which has green CI.
• Major that needs a source change, so it has its own PR: react-router (packages/web-extension, via react-router-dom) 6.30.6 → 7.18.4, Medium, Wiz only (CVE-2026-53666, CVE-2026-53669). See fix: bump react-router-dom to ^7.18.0 in web-extension (dependency vulnerabilities) #41.

Verification

Installed, built and linted again on 2026-10-05:

• Install: ✅ yarn install. The only failure is packages/rrvideo's Playwright browser postinstall, which can't reach the Playwright CDN from the automation sandbox. This happens on main too.
• Build: ✅ yarn build:all passes 22/22. Locally, web-extension's manifest schema validation had to be skipped because the sandbox can't fetch the schema.
• Tests: ✅ CI Tests and WebKit (Safari engine) tests pass on this head commit. The 2026-09-28 sandbox run showed no regressions against main. The only failures were network/browser tests, and the same tests fail on main.
• Lint: ✅ yarn lint has no new errors. The only errors are the same 3 rrweb-player .svelte parser errors as on main. yarn check-types passes 34/34.

Link to Devin session: https://app.devin.ai/sessions/7ce588b86a7c4694bdf0e030b6812b06
Open in Devin Desktop: https://app.devin.ai/desktop/session/7ce588b86a7c4694bdf0e030b6812b06?variant=devin

---

Note

Overview
Addresses dependency advisories with manifest-only version bumps—no application source changes.

vitest is raised from ^3.2.6 to ^4.1.11 in eleven workspace packages (all, browser-client, packer, console/network record plugins, record, replay, rrdom, rrdom-nodejs, rrweb-snapshot, rrweb). That is a major devDependency upgrade for the test runner (GHSA-82fw-gwwq-j7x9); vite stays on ^6.4.2, which vitest 4 supports.

nanoid in packages/web-extension moves from ^4.0.0 to ^5.1.16 (runtime dependency for ID generation in background/session code via ESM import { nanoid }). nanoid 5 is ESM-only; the extension already uses that pattern under Vite.

Lockfiles are not committed in this repo, so consumers must reinstall to pick up resolved versions.

^{Reviewed by Cursor Bugbot for commit 44a6b7e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring