chore(deps): update dependency nanoid@>=3.0.0 <3.3.8 to v5 [security] by renovate[bot] · Pull Request #1195 · memrynote/memry

renovate · 2026-08-09T00:49:11Z

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid@>=3.0.0 <3.3.8	[`3.3.8` → `5.1.16`](https://renovatebot.com/diffs/npm/nanoid@>=3.0.0 <3.3.8/3.3.8/5.1.16)

nanoid: custom generators can loop indefinitely when size is zero

CVE-2026-67213 / GHSA-2v37-7h3g-55p8

More information

Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

nanoid: non-secure generators can loop indefinitely with negative size

CVE-2026-67214 / GHSA-28wg-ghj8-5hjv

More information

Details

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ai/nanoid (nanoid@>=3.0.0 <3.3.8)

`v5.1.16`

Compare Source

Fixed forever loop on negative size (by @spokodev).

`v5.1.15`

Compare Source

Fixed random pool corruption on big ID sizes.

`v5.1.14`

Compare Source

Fixed npm package size regression.

`v5.1.13`

Compare Source

Fixed npm package size regression.

`v5.1.12`

Compare Source

Moved to npm Provenance and Staged Publishing.

`v5.1.11`

Compare Source

Fixed breaking Nano ID by requesting big ID.

`v5.1.10`

Compare Source

Fixed breaking Nano ID by requesting big ID (by @alanzabihi).

`v5.1.9`

Compare Source

Fixed npm package size regression.

`v5.1.8`

Compare Source

Made cusatomAlphabet 75% faster (by @saripovdenis).

`v5.1.7`

Compare Source

Added --version to CLI (by @mahmoodhamdi).
Updated nanoid.js for CDN (by @mahmoodhamdi).
Fixed docs (by @mahmoodhamdi).
Fixed customRandom types (by @oguimbal).

`v5.1.6`

Compare Source

Fixed infinite loop on 0 size for customAlphabet.

`v5.1.5`

Compare Source

Fixed latest version on npm after 3.x release.

`v5.1.4`

Compare Source

Fixed latest version on npm after 3.x release.

`v5.1.3`

Compare Source

Fixed React Native support (by @steida).

`v5.1.2`

Compare Source

Fixed module docs.

`v5.1.1`

Compare Source

Fixed breaking Nano ID by requesting big ID.

`v5.1.0`

Compare Source

Added opaque types support (by @kossnocorp).

`v5.0.9`

Compare Source

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

`v5.0.8`

Compare Source

Reduced customAlphabet size (by @kirillgroshkov).

`v5.0.7`

Compare Source

Fixed Parcel support (by @WilhelmYakunin).

`v5.0.6`

Compare Source

Fixed React Native support.

`v5.0.5`

Compare Source

Make browser’s version faster by increasing size a little (by Samuel Elgozi).

`v5.0.4`

Compare Source

Fixed CLI docs (by @ilyaboka).

`v5.0.3`

Compare Source

Fixed CLI docs (by Chris Schmich).

`v5.0.2`

Compare Source

Fixed webcrypto import (by Divyansh Singh).

`v5.0.1`

Compare Source

Fixed Node.js 18 support.

`v5.0.0`

Compare Source

`v4.0.2`

Compare Source

Added link to Github Sponsors.

`v4.0.1`

Compare Source

Reduced npm package size (by @HiChen404).

Fixed infinite loop on zero size.

`v3.3.16`

Compare Source

Fixed infinite loop on negative size (by @greymoth-jp).

`v3.3.15`

Compare Source

Fixed npm provenance error.

`v3.3.14`

Compare Source

Fixed random pool corruption on big ID sizes.

`v3.3.13`

Compare Source

Reduced npm package size.

`v3.3.12`

Compare Source

Fixed breaking Nano ID by requesting big ID.

`v3.3.11`

Compare Source

Fixed React Native support.

`v3.3.10`

Compare Source

Fixed React Native support (by @steida).

`v3.3.9`

Compare Source

Reduced npm package size.

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov · 2026-08-09T01:07:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

…1356) Bundles five stale bot PRs into a single change against current main so one coherent lockfile lands instead of nine conflicting stale ones. - prettier ^3.8.3 -> ^3.9.6 (#1197) - ip-address override >=10.1.1 -> >=10.3.1, resolves 10.5.0 (#1190, security) - hono override >=4.12.27 -> >=4.12.34, resolves 4.13.1 (#1189, security) - nanoid@>=4.0.0 <5.0.9 override 5.0.9 -> 5.1.16 (#1194) - framer-motion -> motion ^12.24.7 in landing (#1196) The renovate PR for the motion swap replaced the package but left all 49 `from 'framer-motion'` imports untouched, which does not resolve once framer-motion is off the manifest. Repointed them at `motion/react` and updated the vite manualChunks entry that named the old package. Left out deliberately: #1193 (nanoid 6.0.0 major) and #1195 (forces a 3.x transitive to v5) — both advisories are already closed by the existing pins, so they add breakage risk without security value.

renovate Bot added the security label Aug 9, 2026

github-actions Bot added chore dependencies labels Aug 9, 2026

chore(deps): update dependency nanoid@>=3.0.0 <3.3.8 to v5 [security]

f9fd0e5

renovate Bot force-pushed the renovate/npm-nanoid-=3.0.0-3.3.8-vulnerability branch from b08e178 to f9fd0e5 Compare August 9, 2026 09:02

h4yfans mentioned this pull request Aug 12, 2026

chore(deps): land bot dependency bumps in one consolidated lockfile #1356

Merged

Navigation Menu

Uh oh!

chore(deps): update dependency nanoid@>=3.0.0 <3.3.8 to v5 [security] - #1195

chore(deps): update dependency nanoid@>=3.0.0 <3.3.8 to v5 [security]#1195
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nanoid-=3.0.0-3.3.8-vulnerability

renovate Bot commented Aug 9, 2026

Uh oh!

codecov Bot commented Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 9, 2026

nanoid: custom generators can loop indefinitely when size is zero

Details

Severity

References

nanoid: non-secure generators can loop indefinitely with negative size

Details

Severity

References

Release Notes

Configuration

Uh oh!

codecov Bot commented Aug 9, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants