Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 10, 2024

This PR contains the following updates:

Package Change Age Confidence
nanoid 4.0.2 -> 5.0.9 age confidence

GitHub Vulnerability Alerts

CVE-2024-55565

When nanoid is called with a fractional value, there were a number of undesirable effects:

  1. in browser and non-secure, the code infinite loops on while (size--)
  2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
  3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.


Release Notes

ai/nanoid (nanoid)

v5.0.9

Compare Source

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v5.0.8

Compare Source

v5.0.7

Compare Source

v5.0.6

Compare Source

  • Fixed React Native support.

v5.0.5

Compare Source

  • Make browser’s version faster by increasing size a little (by Samuel Elgozi).

v5.0.4

Compare Source

v5.0.3

Compare Source

  • Fixed CLI docs (by Chris Schmich).

v5.0.2

Compare Source

  • Fixed webcrypto import (by Divyansh Singh).

v5.0.1

Compare Source

  • Fixed Node.js 18 support.

v5.0.0

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch 11 times, most recently from 8937dc2 to f431408 Compare January 15, 2025 17:30
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from f431408 to c326a92 Compare March 8, 2025 14:50
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch 15 times, most recently from 38d78c3 to 10c0ace Compare June 1, 2025 09:24
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from 10c0ace to f489bb5 Compare July 22, 2025 21:01
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch 2 times, most recently from e197408 to cfafc9a Compare August 11, 2025 21:35
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch 9 times, most recently from 6a04194 to b06052e Compare August 13, 2025 16:23
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch 6 times, most recently from 9825c04 to 0b465c0 Compare September 7, 2025 17:28
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from 0b465c0 to 85fa217 Compare September 14, 2025 02:08
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from 85fa217 to 36eb0cf Compare September 25, 2025 15:15
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch 6 times, most recently from 81c5fd5 to aaac3c8 Compare October 15, 2025 05:46
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from aaac3c8 to 07444e4 Compare October 15, 2025 10:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants