The verify gate fails on every open PR because npm audit --omit=dev --audit-level=high flags nanoid 3.3.16 (high, GHSA-2v37-7h3g-55p8), pulled in transitively via next → postcss. nanoid 3.3.18 is in postcss's semver range, so a lockfile-only update clears it. This currently blocks Dependabot PRs #148–#152.
The
verifygate fails on every open PR becausenpm audit --omit=dev --audit-level=highflags nanoid 3.3.16 (high, GHSA-2v37-7h3g-55p8), pulled in transitively via next → postcss. nanoid 3.3.18 is in postcss's semver range, so a lockfile-only update clears it. This currently blocks Dependabot PRs #148–#152.