mirror of
https://github.com/toeverything/AFFiNE.git
synced 2026-08-11 22:18:54 +08:00
chore: bump up nanoid version to v5.1.16 [SECURITY] (#15454)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [nanoid](https://redirect.github.com/ai/nanoid) | [`5.1.6` → `5.1.16`](https://renovatebot.com/diffs/npm/nanoid/5.1.6/5.1.16) |  |  | --- ### nanoid: non-secure generators can loop indefinitely with negative size [CVE-2026-67214](https://nvd.nist.gov/vuln/detail/CVE-2026-67214) / [GHSA-28wg-ghj8-5hjv](https://redirect.github.com/advisories/GHSA-28wg-ghj8-5hjv) <details> <summary>More information</summary> #### Details nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition. #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-67214](https://nvd.nist.gov/vuln/detail/CVE-2026-67214) - [https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49](https://redirect.github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49) - [https://github.com/ai/nanoid/releases/tag/5.1.16](https://redirect.github.com/ai/nanoid/releases/tag/5.1.16) - [https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module](https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module) - [https://github.com/ai/nanoid/pull/600](https://redirect.github.com/ai/nanoid/pull/600) - [https://github.com/ai/nanoid/pull/601](https://redirect.github.com/ai/nanoid/pull/601) - [https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d](https://redirect.github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d) - [https://github.com/advisories/GHSA-28wg-ghj8-5hjv](https://redirect.github.com/advisories/GHSA-28wg-ghj8-5hjv) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-28wg-ghj8-5hjv) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>ai/nanoid (nanoid)</summary> ### [`v5.1.16`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5116) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.15...5.1.16) - Fixed forever loop on negative size (by [@​spokodev](https://redirect.github.com/spokodev)). ### [`v5.1.15`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5115) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.14...5.1.15) - Fixed random pool corruption on big ID sizes. ### [`v5.1.14`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5114) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.13...5.1.14) - Fixed npm package size regression. ### [`v5.1.13`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5113) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.12...5.1.13) - Fixed npm package size regression. ### [`v5.1.12`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5112) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.11...5.1.12) - Moved to npm Provenance and Staged Publishing. ### [`v5.1.11`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5111) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.10...5.1.11) - Fixed breaking Nano ID by requesting big ID. ### [`v5.1.10`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5110) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.9...5.1.10) - Fixed breaking Nano ID by requesting big ID (by [@​alanzabihi](https://redirect.github.com/alanzabihi)). ### [`v5.1.9`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#519) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.8...5.1.9) - Fixed npm package size regression. ### [`v5.1.8`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#518) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.7...5.1.8) - Made `cusatomAlphabet` 75% faster (by [@​saripovdenis](https://redirect.github.com/saripovdenis)). ### [`v5.1.7`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#517) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.6...5.1.7) - Added `--version` to CLI (by [@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)). - Updated `nanoid.js` for CDN (by [@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)). - Fixed docs (by [@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)). - Fixed `customRandom` types (by [@​oguimbal](https://redirect.github.com/oguimbal)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6ImNhbmFyeSIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This commit is contained in:
renovate[bot]
@@ -28724,20 +28724,20 @@ __metadata:
|
||||
linkType: hard
|
||||
|
||||
"nanoid@npm:^3.3.16":
|
||||
version: 3.3.16
|
||||
resolution: "nanoid@npm:3.3.16"
|
||||
version: 3.3.18
|
||||
resolution: "nanoid@npm:3.3.18"
|
||||
bin:
|
||||
nanoid: bin/nanoid.cjs
|
||||
checksum: 10/8004af92b5541af1dbd23b69845b5026f777d5b7ef07163cea1837aae86e052ced8b383cecbf8a4f1b5e77ae207df96dc45e16b9e0fa3c4b761d085f1e42851b
|
||||
checksum: 10/1b3b4fdac831b92b56d1dbe8b1e63a372432faf86ea383134e3b53141ef8108a60b7f84343b5cefecac9550bb74edf8164da93ea07d1c4f757039bc75d8a5d9e
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"nanoid@npm:^5.1.6":
|
||||
version: 5.1.6
|
||||
resolution: "nanoid@npm:5.1.6"
|
||||
version: 5.1.16
|
||||
resolution: "nanoid@npm:5.1.16"
|
||||
bin:
|
||||
nanoid: bin/nanoid.js
|
||||
checksum: 10/4109dbcf596d7f297a9b42f459b8f01694a03ebbdd2f41408d963ad54e5ec7234cbe7b4acad137751f31add11bb4fb3415a3e688082516745812811f05570014
|
||||
checksum: 10/b1e702e2b7072e74ac2ae880907d0a291853a36617ec5c3d27d81ab04965ebc0d4d0f707cf9220928cf93d5370b1f561c930efee853dc9c1a3facaefdf1a42ee
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user