fix(deps): resolve nanoid/postcss audit findings and apply pending Dependabot bumps

[sergak01]

Summary

• Fixes the 2 high-severity npm audit findings (nanoid via postcss/vite) by bumping the postcss override to ^8.5.26 and @metricinsights/pp-dev to the latest 1.2.2.
• Ports the currently-safe open Dependabot bumps directly into this branch instead of merging each PR separately:
  • next / eslint-config-next 16.2.12 → 16.3.0 (template-nextjs, template-nextjs-esm)
  • semantic-release 25.0.8 → 25.0.9
  • @semantic-release/git 10.0.1 → 11.0.1
  • @semantic-release/changelog 6.0.3 → 7.0.0
  • @typescript-eslint/eslint-plugin / @typescript-eslint/parser → 8.67.0
  • typescript 6.0.3 → 7.0.2 in template-vanilla only

Remaining audit findings (not fixable here)

5 moderate findings remain (tar, undici, and their npm/@semantic-release/npm/semantic-release chain). They come from bundleDependencies shipped inside the npm package itself (npm@12.0.2, already the latest release) — bundled deps are extracted verbatim from the tarball, so package.json overrides can't reach them. This is a dev-only dependency (used by the release script), not shipped to consumers. Will need an upstream npm CLI release with updated bundled deps.

Held back

The typescript 7.0.2 bump is not applied to template-nextjs, template-nextjs-esm, template-react, or template-vanilla-ts. Their Dependabot PRs (#205, #202, #199, #200) fail CI with an ERESOLVE conflict — @typescript-eslint/parser/eslint-plugin, even at latest (8.67.x), still pin peerDependencies.typescript: ">=4.8.4 <6.1.0". TypeScript 7 isn't supported by typescript-eslint yet, so those 4 PRs are left open/untouched pending upstream support.

Testing

• npm run typecheck ✅
• npm run lint ✅
• npm run build ✅
• npm test — full scaffold suite, 19/19 passing ✅

Merge Request: origin/pp-3989 → origin/develop

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a6160b1e-54af-44a1-a8f7-e23fbd299ca6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}