fix(deps): update dependency nanoid to v3 [security] by renovate[bot] · Pull Request #71 · Chili-Piper/kutt

renovate · 2024-12-10T01:18:08Z

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid	`^2.1.11` → `^3.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Predictable results in nanoid generation when given non-integer values

CVE-2024-55565 / GHSA-mwcw-c2x4-8c55

More information

Details

When nanoid is called with a fractional value, there were a number of undesirable effects:

in browser and non-secure, the code infinite loops on while (size--)
in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

Severity

CVSS Score: 4.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ai/nanoid (nanoid)

`v3.3.8`

Compare Source

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

`v3.3.7`

Compare Source

Fixed node16 TypeScript support (by Saadi Myftija).

`v3.3.6`

Compare Source

Fixed package.

`v3.3.5`

Compare Source

Backport funding information.

`v3.3.4`

Compare Source

Fixed --help in CLI (by @Lete114).

`v3.3.3`

Compare Source

Reduced size (by Anton Khlynovskiy).

`v3.3.2`

Compare Source

Fixed enhanced-resolve support.

`v3.3.1`

Compare Source

Fixed React Native support.

Reduced async exports size (by Artyom Arutyunyan).
Moved from Jest to uvu (by Vitaly Baev).

`v3.1.31`

Compare Source

Fixed collision vulnerability on object in size (by Artyom Arutyunyan).

`v3.1.30`

Compare Source

Reduced size for project with brotli compression (by Anton Khlynovskiy).

`v3.1.29`

Compare Source

Reduced npm package size.

`v3.1.28`

Compare Source

Reduced npm package size.

`v3.1.27`

Compare Source

Cleaned dependencies from development tools.

`v3.1.26`

Compare Source

Improved performance (by Eitan Har-Shoshanim).
Reduced npm package size.

`v3.1.25`

Compare Source

Fixed browserify support.

`v3.1.24`

Compare Source

Fixed browserify support (by Artur Paikin).

`v3.1.23`

Compare Source

Fixed esbuild support.

`v3.1.22`

Compare Source

Added default and browser.default to package.exports.

`v3.1.21`

Compare Source

Reduced npm package size.

`v3.1.20`

Compare Source

Fix ES modules support.

`v3.1.19`

Compare Source

Reduced customAlphabet size (by Enrico Scherlies).

`v3.1.18`

Compare Source

Fixed package.exports.

`v3.1.17`

Compare Source

Added files without process.

`v3.1.16`

Compare Source

Speeded up Nano ID 4 times (by Peter Boyer).

`v3.1.15`

Compare Source

Fixed package.types path.

`v3.1.14`

Compare Source

Added package.types.

`v3.1.13`

Compare Source

Removed Node.js 15.0.0 with randomFillSync regression from engines.node.

`v3.1.12`

Compare Source

Improved IE 11 docs.

`v3.1.11`

Compare Source

Fixed asynchronous customAlphabet in browser (by @LoneRifle).

`v3.1.10`

Compare Source

Fix ES modules support.

`v3.1.9`

Compare Source

Try to fix React Native Expo support.

`v3.1.8`

Compare Source

Add React Native Expo support.

`v3.1.7`

Compare Source

Clean up code.

`v3.1.6`

Compare Source

Avoid self using.

`v3.1.5`

Compare Source

Improve IE docs and warning.

`v3.1.4`

Restrict old Node.js 13 by engines.node (by Cansin Yildiz).

`v3.1.3`

Reduced async exports size (by Artyom Arutyunyan).
Moved from Jest to uvu (by Vitaly Baev).

`v3.1.2`

Compare Source

Reduced npm package size.

`v3.1.1`

Compare Source

Reduced customAlphabet size (by Enrico Scherlies).

`v3.1.0`

Compare Source

`v3.0.2`

Compare Source

Fix docs (by Dylan Irlbeck ).

`v3.0.1`

Compare Source

Fix React Native warning on non-secure import (by Jia Huang).

`v3.0.0`: 3.0 Migration Guide

Compare Source

Nano ID 3.0 is the biggest release in the project history. Unfortunately, you will need to change the code of your application. But the changes are very small in most cases. In return, you will have better performance, smaller size, ES modules and TypeScript support.

Known Issues

Only Create React App 4.0 supports dual ESM/CJS modules.

Simple Case

In simple cases, you just need to change default import to named import.

- import nanoid from 'nanoid'
+ import { nanoid } from 'nanoid'

nanoid() //=> "sSAi9F8yakJZPxOCr_WFb"
nanoid(5) //=> "ISe9l"

If you support IE, you need to transpile node_modules by Babel.

Non-secure and asynchronous Nano ID need only import changes as well.

- import nanoid from 'nanoid/non-secure'
+ import { nanoid } from 'nanoid/non-secure'

nanoid() //=> "sSAi9F8yakJZPxOCr_WFb"

- import nanoid from 'nanoid/async'
+ import { nanoid } from 'nanoid/async'

nanoid().then(id => {
  id //=> "sSAi9F8yakJZPxOCr_WFb"
})

TypeScript

Remove @types/nanoid if you have it. Nano ID now have built-in types.

npm uninstall @&#8203;types/nanoid

React Native

For Expo you need to load the file by direct path:

- import nanoid from "nanoid/async"
+ import { nanoid } from "nanoid/async/index.native.js"

For the non-Expo environment:

Change polyfill for hardware random generator from expo-random to react-native-get-random-values.

Use sync Nano ID instead of async.

+ import 'react-native-get-random-values'

- import nanoid from 'nanoid/async'
+ import { nanoid } from 'nanoid'

  async function createUser () {
    const user = new User()
-   user.id = await nanoid()
+   user.id = nanoid()
    return await user.save()
  }

URL-Safe Alphabet

Our default URL-safe alphabet was moved as named export to nanoid path:

- import url from 'nanoid/url'
+ import { urlAlphabet } from 'nanoid'

Custom Alphabet

Now we use the currying API to change the alphabet. It improves performance by pre-calculating some caches for a new alphabet.

We hope the new API will be more readable compare to the old unclear “generate” word.

- import nanoidGenerate from 'nanoid/generate'
+ import { customAlphabet } from 'nanoid'

+ const nanoid = customAlphabet(alphabet, 10)

- nanoidGenerate(alphabet, 10) //=> "0476921501"
+ nanoid() //=> "0476921501"

Non-secure and asynchronous APIs were also changed:

- import nanoidGenerate from 'nanoid/async/generate'
+ import { customAlphabet } from 'nanoid/async'

+ const nanoid = customAlphabet(alphabet, 10)

Custom Random Generator

Custom random generator API now is based on currying as well.

- import nanoidFormat from 'nanoid/format'
- import url from 'nanoid/url'
+ import { customRandom, urlAlphabet } from 'nanoid'

+ const nanoid = customRandom(urlAlphabet, 10, seedRandom)

- nanoidGenerate(seedRandom, url, 10) //=> "sSAi9F8yak"
+ nanoid() //=> "sSAi9F8yak"

We removed a custom random generator from asynchronous API because we didn’t see that somebody used it.

New Features

A few good reasons, why you should migrate to Nano ID 3.0:

The size was decreased by 10% from 119 to 108 bytes.

We got full TypeScript support. We use check-dts to test out .d.ts files.

id: number = nanoid() // throws Type 'string' is not assignable to type 'number'.

Nano ID now has out-of-the-box ES modules support and extra file to load Nano ID from jsDelivr (use it only for experiments, because of the bad loading performance). Dual ESM/CommonJS packaging is provided by dual-publish and will work in Node.js ≥12, webpack, Parcel, Rollup, and React Native.
```
import { nanoid } from 'https://cdn.jsdelivr.net/npm/nanoid/nanoid.js'
```

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/npm-nanoid-vulnerability branch from fea2d30 to db51af7 Compare August 10, 2025 14:12

renovate Bot force-pushed the renovate/npm-nanoid-vulnerability branch from db51af7 to d74b5e5 Compare December 31, 2025 13:52

fix(deps): update dependency nanoid to v3 [security]

c349904

renovate Bot force-pushed the renovate/npm-nanoid-vulnerability branch from d74b5e5 to c349904 Compare May 1, 2026 06:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency nanoid to v3 [security]#71

fix(deps): update dependency nanoid to v3 [security]#71
renovate[bot] wants to merge 1 commit into
developfrom
renovate/npm-nanoid-vulnerability

renovate Bot commented Dec 10, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Dec 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Predictable results in nanoid generation when given non-integer values

Details

Severity

References

Release Notes

v3.0.0: 3.0 Migration Guide

Known Issues

Simple Case

TypeScript

React Native

URL-Safe Alphabet

Custom Alphabet

Custom Random Generator

New Features

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Dec 10, 2024 •

edited

Loading

`v3.0.0`: 3.0 Migration Guide