fix(deps): update dependency nanoid to v3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nanoid	^2.1.11 -> ^3.0.0

GitHub Vulnerability Alerts

CVE-2024-55565

When nanoid is called with a fractional value, there were a number of undesirable effects:

1. in browser and non-secure, the code infinite loops on while (size--)
2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

---

Release Notes

ai/nanoid (nanoid)

v3.3.8

Compare Source

• Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v3.3.7

Compare Source

• Fixed node16 TypeScript support (by Saadi Myftija).

v3.3.6

Compare Source

• Fixed package.

v3.3.5

Compare Source

• Backport funding information.

v3.3.4

Compare Source

• Fixed --help in CLI (by @​Lete114).

v3.3.3

Compare Source

• Reduced size (by Anton Khlynovskiy).

v3.3.2

Compare Source

• Fixed enhanced-resolve support.

v3.3.1

Compare Source

• Reduced package size.

v3.3.0

Compare Source

v3.2.0

Compare Source

v3.1.32

Compare Source

• Reduced async exports size (by Artyom Arutyunyan).
• Moved from Jest to uvu (by Vitaly Baev).

v3.1.31

Compare Source

• Fixed collision vulnerability on object in size (by Artyom Arutyunyan).

v3.1.30

Compare Source

• Reduced size for project with brotli compression (by Anton Khlynovskiy).

v3.1.29

Compare Source

• Reduced npm package size.

v3.1.28

Compare Source

• Reduced npm package size.

v3.1.27

Compare Source

• Cleaned dependencies from development tools.

v3.1.26

Compare Source

• Improved performance (by Eitan Har-Shoshanim).
• Reduced npm package size.

v3.1.25

Compare Source

• Fixed browserify support.

v3.1.24

Compare Source

• Fixed browserify support (by Artur Paikin).

v3.1.23

Compare Source

• Fixed esbuild support.

v3.1.22

Compare Source

• Added default and browser.default to package.exports.

v3.1.21

Compare Source

• Reduced npm package size.

v3.1.20

Compare Source

• Fix ES modules support.

v3.1.19

Compare Source

• Reduced customAlphabet size (by Enrico Scherlies).

v3.1.18

Compare Source

• Fixed package.exports.

v3.1.17

Compare Source

• Added files without process.

v3.1.16

Compare Source

• Speeded up Nano ID 4 times (by Peter Boyer).

v3.1.15

Compare Source

• Fixed package.types path.

v3.1.14

Compare Source

• Added package.types.

v3.1.13

Compare Source

• Removed Node.js 15.0.0 with randomFillSync regression from engines.node.

v3.1.12

Compare Source

• Improved IE 11 docs.

v3.1.11

Compare Source

• Fixed asynchronous customAlphabet in browser (by @​LoneRifle).

v3.1.10

Compare Source

• Fix ES modules support.

v3.1.9

Compare Source

• Try to fix React Native Expo support.

v3.1.8

Compare Source

• Add React Native Expo support.

v3.1.7

Compare Source

• Clean up code.

v3.1.6

Compare Source

• Avoid self using.

v3.1.5

Compare Source

• Improve IE docs and warning.

v3.1.4

• Restrict old Node.js 13 by engines.node (by Cansin Yildiz).

v3.1.3

• Reduced async exports size (by Artyom Arutyunyan).
• Moved from Jest to uvu (by Vitaly Baev).

v3.1.2

Compare Source

• Reduced npm package size.

v3.1.1

Compare Source

• Reduced customAlphabet size (by Enrico Scherlies).

v3.1.0

Compare Source

v3.0.2

Compare Source

• Fix docs (by Dylan Irlbeck ).

v3.0.1

Compare Source

• Fix React Native warning on non-secure import (by Jia Huang).

v3.0.0: 3.0 Migration Guide

Compare Source

Nano ID 3.0 is the biggest release in the project history. Unfortunately, you will need to change the code of your application. But the changes are very small in most cases. In return, you will have better performance, smaller size, ES modules and TypeScript support.

Known Issues

• Only Create React App 4.0 supports dual ESM/CJS modules.

Simple Case

In simple cases, you just need to change default import to named import.

- import nanoid from 'nanoid'
+ import { nanoid } from 'nanoid'

nanoid() //=> "sSAi9F8yakJZPxOCr_WFb"
nanoid(5) //=> "ISe9l"

If you support IE, you need to transpile node_modules by Babel.

Non-secure and asynchronous Nano ID need only import changes as well.

- import nanoid from 'nanoid/non-secure'
+ import { nanoid } from 'nanoid/non-secure'

nanoid() //=> "sSAi9F8yakJZPxOCr_WFb"

- import nanoid from 'nanoid/async'
+ import { nanoid } from 'nanoid/async'

nanoid().then(id => {
  id //=> "sSAi9F8yakJZPxOCr_WFb"
})

TypeScript

Remove @types/nanoid if you have it. Nano ID now have built-in types.

npm uninstall @​types/nanoid

React Native

For Expo you need to load the file by direct path:

- import nanoid from "nanoid/async"
+ import { nanoid } from "nanoid/async/index.native.js"

For the non-Expo environment:

1. Change polyfill for hardware random generator from expo-random to react-native-get-random-values.

2. Use sync Nano ID instead of async.

   + import 'react-native-get-random-values'
   
   - import nanoid from 'nanoid/async'
   + import { nanoid } from 'nanoid'
   
     async function createUser () {
       const user = new User()
   -   user.id = await nanoid()
   +   user.id = nanoid()
       return await user.save()
     }

URL-Safe Alphabet

Our default URL-safe alphabet was moved as named export to nanoid path:

- import url from 'nanoid/url'
+ import { urlAlphabet } from 'nanoid'

Custom Alphabet

Now we use the currying API to change the alphabet. It improves performance by pre-calculating some caches for a new alphabet.

We hope the new API will be more readable compare to the old unclear “generate” word.

- import nanoidGenerate from 'nanoid/generate'
+ import { customAlphabet } from 'nanoid'

+ const nanoid = customAlphabet(alphabet, 10)

- nanoidGenerate(alphabet, 10) //=> "0476921501"
+ nanoid() //=> "0476921501"

Non-secure and asynchronous APIs were also changed:

- import nanoidGenerate from 'nanoid/async/generate'
+ import { customAlphabet } from 'nanoid/async'

+ const nanoid = customAlphabet(alphabet, 10)

Custom Random Generator

Custom random generator API now is based on currying as well.

- import nanoidFormat from 'nanoid/format'
- import url from 'nanoid/url'
+ import { customRandom, urlAlphabet } from 'nanoid'

+ const nanoid = customRandom(urlAlphabet, 10, seedRandom)

- nanoidGenerate(seedRandom, url, 10) //=> "sSAi9F8yak"
+ nanoid() //=> "sSAi9F8yak"

We removed a custom random generator from asynchronous API because we didn’t see that somebody used it.

New Features

A few good reasons, why you should migrate to Nano ID 3.0:

• The size was decreased by 10% from 119 to 108 bytes.
• We got full TypeScript support. We use check-dts to test out .d.ts files.

  id: number = nanoid() // throws Type 'string' is not assignable to type 'number'.

• Nano ID now has out-of-the-box ES modules support and extra file to load Nano ID from jsDelivr (use it only for experiments, because of the bad loading performance). Dual ESM/CommonJS packaging is provided by dual-publish and will work in Node.js ≥12, webpack, Parcel, Rollup, and React Native.

  import { nanoid } from 'https://cdn.jsdelivr.net/npm/nanoid/nanoid.js'

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.