Prepare 1.1.5: revert nanoid to 5.1.16 (Wasm Node-25 engine fix)

[monkopedia-coder]

Patch release 1.1.5. Fixes a Wasm-toolchain landmine introduced by the nanoid 6 bump in 1.1.4.

Problem

nanoid 6.0.0 declares engines.node = "^22 || ^24 || >=26" — which excludes Node 25, the default managed Node that Kotlin 2.4.10 provisions for the Wasm/JS toolchain. A downstream consumer doing a full Wasm build hit :kotlinWasmNpmInstall failing on the fresh nanoid@6 resolve.

ksrpc's own CI never caught it: the lint job's apiCheck builds klibs (which don't npm-link), and compileKotlinWasmJs compiles the external binding without an npm install — so :kotlinWasmNpmInstall is never run in CI. The 1.1.4 bump was also effectively inert in ksrpc's own build (the nanoid() binding is unchanged), but it was published to consumers.

Fix

Revert the npm dep to nanoid 5.1.16 (engines.node = "^18 || >=20", identical nanoid() API). ksrpc no longer imposes a Node floor on its Wasm/JS consumers. kotlin-js-store lockfiles are gitignored, so there's nothing to commit there — the catalog npm() version is the pin.

Verification

• Ran :kotlinWasmNpmInstall + :kotlinNpmInstall locally (green) against the 2.4.10 toolchain, which provisions Node 25 on this box — this is the exact step that failed for the consumer, now passing with 5.1.16.
• apiCheck byte-identical (jvm + klib); no API/ABI change.
• Only tracked changes: gradle/libs.versions.toml, gradle.properties, CHANGELOG.md.

Cross-repo: the broader Kotlin 2.4.10 managed-Node-25 hardening (pinning Node 22 LTS across repos) is being standardized separately by the release coordinator; this PR fixes ksrpc at the source by not shipping nanoid@6.

[monkopedia-reviewer]

Vetted line-by-line. Summary of what was checked:

nanoid revert (5.1.16 ← 6.0.0): Confirmed directly against the npm registry: nanoid 5.1.16 declares engines.node = "^18 || >=20" (Node 25 is ≥20 — no exclusion), while nanoid 6.0.0 declares engines.node = "^22 || ^24 || >=26" (explicitly excludes Node 25). The nanoid() JS API is identical between the two versions, so this revert is safe and non-breaking for all consumers. Root cause and fix are accurate as stated.

Version bump: gradle.properties bumped 1.1.4 → 1.1.5 — correct semver for a dep-only patch fix.

CHANGELOG.md: New 1.1.5 entry accurately describes the problem (nanoid 6 engine exclusion of Node 25, Kotlin 2.4.10 Wasm toolchain, downstream :kotlinWasmNpmInstall failure), the fix (revert to 5.1.16), and notes the API is unchanged and the inert nature in ksrpc's own build.

Scope: Exactly 3 tracked files changed (CHANGELOG.md, gradle.properties, gradle/libs.versions.toml). Zero .api/.klib.api files in the diff — ABI byte-identical as expected for an npm-only dep change. kotlin-js-store lockfiles are gitignored (confirmed in repo .gitignore) — correctly nothing committed there.

CI: All 6 required checks green (apple, compiler-tests, jni-tests, jvm-tests, lint, native-tests). Local verification of :kotlinWasmNpmInstall + :kotlinNpmInstall against Node 25/Kotlin 2.4.10 reported green by the author — this is the exact step CI does not exercise (the gap that let 1.1.4 ship with the landmine), so author verification is the correct supplemental gate here.

Owner pre-authorization: Jason explicitly authorized this revert and the 1.1.5 release cut. Handing to the ksrpc agent to merge + tag + publish per that delegation.