Skip to content

Build(deps): [security] bump nanoid from 3.3.6 to 3.3.8 in /ui

Ronan Amicel requested to merge dependabot-npm_and_yarn-ui-nanoid-3.3.8 into main

Bumps nanoid from 3.3.6 to 3.3.8. This update includes a security fix.

Vulnerabilities fixed

Infinite loop in nanoid
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.

Patched versions: 3.3.8; 5.0.9
Affected versions: = 4.0.0, < 5.0.9

Changelog

Sourced from nanoid's changelog.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

3.3.7

  • Fixed node16 TypeScript support (by Saadi Myftija).
Commits

Merge request reports

Loading