Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 10, 2024

This PR contains the following updates:

Package Change Age Confidence
nanoid ^4.0.0 -> ^5.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2024-55565

When nanoid is called with a fractional value, there were a number of undesirable effects:

  1. in browser and non-secure, the code infinite loops on while (size--)
  2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
  3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.


Release Notes

ai/nanoid (nanoid)

v5.0.9

Compare Source

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v5.0.8

Compare Source

v5.0.7

Compare Source

v5.0.6

Compare Source

  • Fixed React Native support.

v5.0.5

Compare Source

  • Make browser’s version faster by increasing size a little (by Samuel Elgozi).

v5.0.4

Compare Source

v5.0.3

Compare Source

  • Fixed CLI docs (by Chris Schmich).

v5.0.2

Compare Source

  • Fixed webcrypto import (by Divyansh Singh).

v5.0.1

Compare Source

  • Fixed Node.js 18 support.

v5.0.0

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch 2 times, most recently from 1e7d32f to 78d5755 Compare August 13, 2025 17:26
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from 78d5755 to a627d65 Compare August 19, 2025 13:36
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from a627d65 to b250d87 Compare August 31, 2025 11:07
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from b250d87 to 3e22b04 Compare September 25, 2025 16:33
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from 3e22b04 to bbc0227 Compare October 21, 2025 11:15
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from bbc0227 to 299109a Compare November 11, 2025 02:16
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from 299109a to 514dd69 Compare November 18, 2025 22:59
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from 514dd69 to 7c89228 Compare December 3, 2025 19:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant