fix(deps): resolve open Dependabot security alerts (nanoid, js-yaml) (#7113)

Bump the vulnerable dependencies flagged by the open Dependabot alerts to
their first patched versions.

nanoid 3.3.8/3.3.12/3.3.16 -> 3.3.18 (high)
  - GHSA-28wg-ghj8-5hjv / CVE-2026-67214: non-secure generators can loop
    indefinitely with negative size (fixed in 3.3.16)
  - GHSA-2v37-7h3g-55p8 / CVE-2026-67213: custom generators can loop
    indefinitely when size is zero (fixed in 3.3.18)

js-yaml 4.3.0 -> 4.3.1 and 3.15.0 -> 3.15.1 (high)
  - GHSA-5p4m-2wfm-xmqj: quadratic CPU consumption in !!omap resolution

The nanoid bump updates the exact pins in @aws-amplify/ui-vue,
@aws-amplify/ui-svelte and @aws-amplify/ui-angular; js-yaml is a dev-only
transitive dependency updated in place in the lockfiles. Dependency sets
are unchanged across all bumped versions, so the lockfile delta is limited
to the affected entries.

extract-zip (GHSA-jmr9-qjv8-65gv) is intentionally not addressed: no
patched version exists upstream (2.0.1 is latest and still vulnerable).

Author: soberm

build-system-tests/e2e/yarn.lock

@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@aws-amplify/ui": "6.15.5",
-    "nanoid": "3.3.8",
+    "nanoid": "3.3.18",
     "qrcode": "1.5.0",
     "tslib": "^2.5.2",
     "xstate": "^4.33.6"

packages/angular/projects/ui-angular/package.json

@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "@aws-amplify/ui": "6.15.5",
-    "nanoid": "3.3.8",
+    "nanoid": "3.3.18",
     "qrcode": "1.5.0",
     "xstate": "^4.33.6"
   },

packages/svelte/package.json

@@ -41,7 +41,7 @@
     "@aws-amplify/ui": "6.15.5",
     "@vueuse/core": "7.5.5",
     "@xstate/vue": "0.8.1",
-    "nanoid": "3.3.8",
+    "nanoid": "3.3.18",
     "qrcode": "1.5.0",
     "xstate": "^4.33.6"
   },