fix: update vulnerable version of nanoid to 3.2.0

[thaddmt]

Overview

• Ran tests and ran in local app

• [x] briefly describe the changes in this PR
• [ ] write tests for all new functionality
• [ ] run npm run docs and commit changes to API.md
• [ ] update CHANGELOG.md with changes under master heading before merging

[wipfli]

Are we using package-lock.json at all?

[wipfli]

What are the breaking changes in nanoid v3?

[thaddmt]

Are we using package-lock.json at all?

Going to make a separate PR after this to use package-lock.json. Was mostly using yarn before this but figure most of the other maplibre packages use NPM and we should follow suit here.

[wipfli]

Nice. In GL JS we use nvm use 16. Ideally we do the same here.

[thaddmt]

What are the breaking changes in nanoid v3?

Actually realized after looking into it more we removed the code that used nanoid when we forked from mapbox-gl-geocoder so it is no longer needed :)

[wipfli]

You are right, and there are more in the devDependencies:

➜  maplibre-gl-geocoder git:(main) npx depcheck
Unused dependencies
* nanoid
Unused devDependencies
* brfs
* browserify
* budo
* documentation
* envify
* eslint
* husky
* smokestack
* tap-color
* tap-status
* uglify-js

[wipfli]

If you migrate package-lock.json to v2, please also update the contributors guidelines and tell people to use nvm use 16.

[thaddmt]

You are right, and there are more in the devDependencies:

➜  maplibre-gl-geocoder git:(main) npx depcheck
Unused dependencies
* nanoid
Unused devDependencies
* brfs
* browserify
* budo
* documentation
* envify
* eslint
* husky
* smokestack
* tap-color
* tap-status
* uglify-js

Yep! was planning to get to those also in a separate PR since I wanted to take more time to verify they aren't needed