From 27c86bf0b70cc751bb8fc29dd741b9a8002b96d6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 22 Sep 2026 12:19:07 +0000
Subject: [PATCH 1/2] chore(deps): bump nanoid from 3.3.11 to 3.3.19 in
 /playground

Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.11 to 3.3.19.
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ai/nanoid/compare/3.3.11...3.3.19)

---
updated-dependencies:
- dependency-name: nanoid
  dependency-version: 3.3.19
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 playground/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/playground/package-lock.json b/playground/package-lock.json
index 7026326..5fce252 100644
--- a/playground/package-lock.json
+++ b/playground/package-lock.json
@@ -897,9 +897,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.19",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
       "dev": true,
       "funding": [
         {

From ae83ac9d154f19c4706715b31b6bb86974e37f71 Mon Sep 17 00:00:00 2001
From: Nikolai Denissov <ext-nikolai.denissov@aalto.fi>
Date: Fri, 9 Oct 2026 08:59:34 +0300
Subject: [PATCH 2/2] Test nanoid integration and refresh playground Nix
 dependencies

---
 .github/workflows/playground-dependencies.yml | 32 +++++++++++++++++++
 playground.nix                                |  2 +-
 playground/package.json                       |  3 +-
 playground/tests/dependencies/nanoid.test.mjs | 20 ++++++++++++
 4 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/playground-dependencies.yml
 create mode 100644 playground/tests/dependencies/nanoid.test.mjs

diff --git a/.github/workflows/playground-dependencies.yml b/.github/workflows/playground-dependencies.yml
new file mode 100644
index 0000000..e9b5b7c
--- /dev/null
+++ b/.github/workflows/playground-dependencies.yml
@@ -0,0 +1,32 @@
+name: Playground dependency contracts
+on:
+  pull_request:
+    paths: ['playground/**', 'playground.nix', '.github/workflows/playground-dependencies.yml']
+  push:
+    branches: [main]
+    paths: ['playground/**', 'playground.nix', '.github/workflows/playground-dependencies.yml']
+permissions:
+  contents: read
+jobs:
+  contracts:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: playground
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: playground/package-lock.json
+      - run: npm ci
+      - run: npm run test:dependencies
+  production-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - run: nix-build -A packages.playground
diff --git a/playground.nix b/playground.nix
index d4f738a..21614f4 100644
--- a/playground.nix
+++ b/playground.nix
@@ -11,7 +11,7 @@ pkgs.buildNpmPackage {
 
   src = ./playground;
 
-  npmDepsHash = "sha256-6nntf8nFU5i23anG1WPOvqTcUu7LHXV0lPOYxqEhkv8=";
+  npmDepsHash = "sha256-bOBEVFz3nTmBkzjfAq0bb0j9f8k5HLKhyDIrm5wnhCU=";
 
   nativeBuildInputs = [
     pkgs.wasm-bindgen-cli
diff --git a/playground/package.json b/playground/package.json
index e9345c9..1f659c2 100644
--- a/playground/package.json
+++ b/playground/package.json
@@ -5,7 +5,8 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "test:dependencies": "node --test tests/dependencies/*.test.mjs"
   },
   "dependencies": {
     "monaco-editor": "^0.52.0",
diff --git a/playground/tests/dependencies/nanoid.test.mjs b/playground/tests/dependencies/nanoid.test.mjs
new file mode 100644
index 0000000..fa8715e
--- /dev/null
+++ b/playground/tests/dependencies/nanoid.test.mjs
@@ -0,0 +1,20 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { nanoid } from 'nanoid';
+import postcss from 'postcss';
+
+test('PostCSS Input IDs remain nonempty and distinct for anonymous stylesheets', () => {
+  const first = postcss.parse('.editor { color: red }').source.input;
+  const second = postcss.parse('.editor { color: blue }').source.input;
+  assert.match(first.id, /^<input css .+>$/);
+  assert.notEqual(first.id, second.id);
+  assert.equal(first.css, '.editor { color: red }');
+});
+
+test('generated stylesheet identifiers preserve the requested size and URL-safe alphabet', () => {
+  for (const size of [0, 6, 21, 64]) {
+    const id = nanoid(size);
+    assert.equal(id.length, size);
+    assert.match(id, /^[A-Za-z0-9_-]*$/);
+  }
+});