[Angnuo (angnuoli)]

Summary

• Replace closed Dependabot PR build(deps): bump nanoid from 3.3.12 to 3.3.18 in /desktop/renderer #201 with a focused update based on current main (d9236f9).
• Update renderer's transitive nanoid dependency from 3.3.12 to 3.3.19, rather than the old PR's 3.3.18 target. Official 3.3.19 notes: fixes application crashes caused by oversized user IDs.
• Change only nanoid's version and SHA512 integrity in desktop/renderer/package-lock.json. Preserve all unrelated lockfile metadata, including jschardet's resolved entry.

Validation

• Current configured npm mirror provides nanoid 3.3.19. Downloaded its tarball without executing scripts and verified SHA512 against registry metadata.
• Renderer npm ci: passed (392 packages). npm's existing script allowlist warned about esbuild/vue-demi; no script policy was changed.
• Nanoid smoke checks: installed version 3.3.19, default ID generation, custom alphabet generation, oversized-ID rejection, and PostCSS resolving the updated nanoid all passed.
• Renderer tests: 54 files passed; 797 tests passed, 2 skipped.
• Renderer lint: 0 errors, 106 existing warnings.
• Desktop TypeScript and renderer production build: passed (Vite 6.4.4), with existing bundle/annotation warnings.
• Prettier on the changed lockfile and git diff --check: passed.
• Structural lockfile comparison confirms only the intended nanoid version/integrity fields changed; desktop manifest/lockfile and renderer manifest are unchanged.

Existing baseline and CI limitations

• Desktop npm ci still fails on main's existing jschardet lock mismatch (locked 3.1.4 versus the formatter's latest dependency resolving to 4.0.0). This PR does not modify desktop dependencies or fix that separate issue, and does not claim a successful whole-project clean install.
• For local validation only, desktop prerequisites were installed using --ignore-scripts --no-save --package-lock=false. The same-version (33.4.11), SHA256-matching Electron runtime was reused from the existing local installation. No npm security policy was weakened.
• GitHub PR Build remains queued on the self-hosted Windows runner; CLA passed. Remote CI is not being reported as passed. Current main rules have no required CI checks; merge will use the normal manual squash path without an administrator override or auto-merge.

Reference

• https://github.com/ai/nanoid/releases/tag/3.3.19