New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency nanoid to v5 [security] #814

Open

renovate wants to merge 1 commit into main from renovate/npm-nanoid-vulnerability

Contributor

renovate bot commented Dec 10, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nanoid	`4.0.2` -> `5.0.9`

GitHub Vulnerability Alerts

CVE-2024-55565

When nanoid is called with a fractional value, there were a number of undesirable effects:

in browser and non-secure, the code infinite loops on while (size--)
in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

Release Notes

ai/nanoid (nanoid)

`v5.0.9`

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

`v5.0.8`

Reduced customAlphabet size (by @kirillgroshkov).

`v5.0.7`

Fixed Parcel support (by @WilhelmYakunin).

`v5.0.6`

Fixed React Native support.

`v5.0.5`

Make browser’s version faster by increasing size a little (by Samuel Elgozi).

`v5.0.4`

Fixed CLI docs (by @ilyaboka).

`v5.0.3`

Fixed CLI docs (by Chris Schmich).

`v5.0.2`

Fixed webcrypto import (by Divyansh Singh).

`v5.0.1`

Fixed Node.js 18 support.

`v5.0.0`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          fix(deps): update dependency nanoid to v5 [security]

d146707

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet