Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency nanoid to v3.3.8 [security] #641

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 10, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
nanoid 3.2.0 -> 3.3.8 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-55565

When nanoid is called with a fractional value, there were a number of undesirable effects:

  1. in browser and non-secure, the code infinite loops on while (size--)
  2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
  3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.


Release Notes

ai/nanoid (nanoid)

v3.3.8

Compare Source

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v3.3.7

Compare Source

  • Fixed node16 TypeScript support (by Saadi Myftija).

v3.3.6

Compare Source

  • Fixed package.

v3.3.5

Compare Source

  • Backport funding information.

v3.3.4

Compare Source

v3.3.3

Compare Source

  • Reduced size (by Anton Khlynovskiy).

v3.3.2

Compare Source

  • Fixed enhanced-resolve support.

v3.3.1

Compare Source

  • Reduced package size.

v3.3.0

Compare Source


Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from Hiratake as a code owner December 10, 2024 14:52
@renovate renovate bot added 🔒problem:security セキュリティに関する問題 🤖dependencies Pull requests that update a dependency file labels Dec 10, 2024
Copy link

codecov bot commented Dec 10, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (bdfe7ee) to head (41ca24f).

Additional details and impacted files
@@            Coverage Diff            @@
##               dev      #641   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            1         1           
  Lines           26        26           
  Branches        12        12           
=========================================
  Hits            26        26           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@renovate renovate bot changed the title fix(deps): update dependency nanoid to v3.3.8 [security] fix(deps): update dependency nanoid to v3.3.8 [security] - autoclosed Dec 11, 2024
@renovate renovate bot closed this Dec 11, 2024
@renovate renovate bot deleted the renovate/npm-nanoid-vulnerability branch December 11, 2024 01:04
@renovate renovate bot changed the title fix(deps): update dependency nanoid to v3.3.8 [security] - autoclosed fix(deps): update dependency nanoid to v3.3.8 [security] Dec 13, 2024
@renovate renovate bot reopened this Dec 13, 2024
@renovate renovate bot force-pushed the renovate/npm-nanoid-vulnerability branch from f48c538 to 41ca24f Compare December 13, 2024 03:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🤖dependencies Pull requests that update a dependency file 🔒problem:security セキュリティに関する問題
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants