From 46ea493ecbbcd463b374483e57ca1c7f7890c786 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 09:28:27 +0800 Subject: [PATCH] chore: bump up nanoid version to v5.1.16 [SECURITY] (#15454) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [nanoid](https://redirect.github.com/ai/nanoid) | [`5.1.6` → `5.1.16`](https://renovatebot.com/diffs/npm/nanoid/5.1.6/5.1.16) | ![age](https://developer.mend.io/api/mc/badges/age/npm/nanoid/5.1.16?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nanoid/5.1.6/5.1.16?slim=true) | --- ### nanoid: non-secure generators can loop indefinitely with negative size [CVE-2026-67214](https://nvd.nist.gov/vuln/detail/CVE-2026-67214) / [GHSA-28wg-ghj8-5hjv](https://redirect.github.com/advisories/GHSA-28wg-ghj8-5hjv)
More information #### Details nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition. #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-67214](https://nvd.nist.gov/vuln/detail/CVE-2026-67214) - [https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49](https://redirect.github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49) - [https://github.com/ai/nanoid/releases/tag/5.1.16](https://redirect.github.com/ai/nanoid/releases/tag/5.1.16) - [https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module](https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module) - [https://github.com/ai/nanoid/pull/600](https://redirect.github.com/ai/nanoid/pull/600) - [https://github.com/ai/nanoid/pull/601](https://redirect.github.com/ai/nanoid/pull/601) - [https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d](https://redirect.github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d) - [https://github.com/advisories/GHSA-28wg-ghj8-5hjv](https://redirect.github.com/advisories/GHSA-28wg-ghj8-5hjv) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-28wg-ghj8-5hjv) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
--- ### Release Notes
ai/nanoid (nanoid) ### [`v5.1.16`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5116) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.15...5.1.16) - Fixed forever loop on negative size (by [@​spokodev](https://redirect.github.com/spokodev)). ### [`v5.1.15`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5115) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.14...5.1.15) - Fixed random pool corruption on big ID sizes. ### [`v5.1.14`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5114) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.13...5.1.14) - Fixed npm package size regression. ### [`v5.1.13`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5113) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.12...5.1.13) - Fixed npm package size regression. ### [`v5.1.12`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5112) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.11...5.1.12) - Moved to npm Provenance and Staged Publishing. ### [`v5.1.11`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5111) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.10...5.1.11) - Fixed breaking Nano ID by requesting big ID. ### [`v5.1.10`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5110) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.9...5.1.10) - Fixed breaking Nano ID by requesting big ID (by [@​alanzabihi](https://redirect.github.com/alanzabihi)). ### [`v5.1.9`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#519) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.8...5.1.9) - Fixed npm package size regression. ### [`v5.1.8`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#518) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.7...5.1.8) - Made `cusatomAlphabet` 75% faster (by [@​saripovdenis](https://redirect.github.com/saripovdenis)). ### [`v5.1.7`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#517) [Compare Source](https://redirect.github.com/ai/nanoid/compare/5.1.6...5.1.7) - Added `--version` to CLI (by [@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)). - Updated `nanoid.js` for CDN (by [@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)). - Fixed docs (by [@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)). - Fixed `customRandom` types (by [@​oguimbal](https://redirect.github.com/oguimbal)).
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- yarn.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index 2616e7a1ce..a771948ce3 100644 --- a/yarn.lock +++ b/yarn.lock @@ -28724,20 +28724,20 @@ __metadata: linkType: hard "nanoid@npm:^3.3.16": - version: 3.3.16 - resolution: "nanoid@npm:3.3.16" + version: 3.3.18 + resolution: "nanoid@npm:3.3.18" bin: nanoid: bin/nanoid.cjs - checksum: 10/8004af92b5541af1dbd23b69845b5026f777d5b7ef07163cea1837aae86e052ced8b383cecbf8a4f1b5e77ae207df96dc45e16b9e0fa3c4b761d085f1e42851b + checksum: 10/1b3b4fdac831b92b56d1dbe8b1e63a372432faf86ea383134e3b53141ef8108a60b7f84343b5cefecac9550bb74edf8164da93ea07d1c4f757039bc75d8a5d9e languageName: node linkType: hard "nanoid@npm:^5.1.6": - version: 5.1.6 - resolution: "nanoid@npm:5.1.6" + version: 5.1.16 + resolution: "nanoid@npm:5.1.16" bin: nanoid: bin/nanoid.js - checksum: 10/4109dbcf596d7f297a9b42f459b8f01694a03ebbdd2f41408d963ad54e5ec7234cbe7b4acad137751f31add11bb4fb3415a3e688082516745812811f05570014 + checksum: 10/b1e702e2b7072e74ac2ae880907d0a291853a36617ec5c3d27d81ab04965ebc0d4d0f707cf9220928cf93d5370b1f561c930efee853dc9c1a3facaefdf1a42ee languageName: node linkType: hard