fix: clear nightly CI audit failure (nanoid 3.3.18) and group Dependabot updates — 3.1.1

.github/dependabot.yml

@@ -3,8 +3,23 @@ updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 10
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
     labels:
       - "dependencies"
       - "security"
+    # Routine version updates are batched into two pull requests. Dependabot
+    # security updates are generated independently of these groups and are NOT
+    # suppressed by grouping - they continue to open individually and promptly.
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      development-dependencies:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"

CHANGELOG.md

@@ -17,6 +17,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [3.1.1] - 2026-08-26
+
+### Fixed
+- Production `npm audit` high-severity finding resolved: `nanoid` bumped to
+  **3.3.18** to close GHSA-2v37-7h3g-55p8, restoring a green nightly CI audit
+  on the staging line
+
+### Changed
+- Dependabot now groups routine minor and patch npm updates into one production
+  and one development pull request per week instead of one pull request per
+  package; security updates are unaffected and continue to open individually
+
+---
+
 ## [3.1.0] - 2026-08-04
 
 ### Added

VERSION.md

@@ -1 +1 @@
-3.1.0
+3.1.1

package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelseed-ui",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "private": true,
   "scripts": {
     "predev": "node scripts/sync-version-from-env.mjs",