Skip to content

[Security] Bump nanoid from 3.3.7 to 3.3.8

DependabotFichesTerritoriales requested to merge dependabot-npm_and_yarn-nanoid-3.3.8 into main

Bumps nanoid from 3.3.7 to 3.3.8. This update includes a security fix.

Vulnerabilities fixed

Infinite loop in nanoid nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.

Patched versions: 3.3.8 Affected versions: < 3.3.8

Changelog

Sourced from nanoid's changelog.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).
Commits

Merge request reports