🚨 [security] Update nanoid 3.3.4 → 3.3.8 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ nanoid (3.3.4 → 3.3.8) · Repo · Changelog

Security Advisories 🚨

🚨 Infinite loop in nanoid

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.

Release Notes

3.3.8 (from changelog)

• Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

3.3.6 (from changelog)

• Fixed package.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 13 commits:

• Release 3.3.8 version
• Update size limit
• Fix pool pollution, infinite loop (#510)
• Release 3.3.7 version
• Update dual-publish
• Remove benchmark from CI for v3
• Fix CI for v3
• Move to pnpm 8
• Release 3.3.6 version
• Release 3.3.5 version
• Backport funding option
• Update dependencies
• Update IE polyfill to fix last improve with reduce (#362)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)