fix(deps): update dependency nanoid to v5.0.9 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nanoid	5.0.8 -> 5.0.9

---

Predictable results in nanoid generation when given non-integer values

CVE-2024-55565 / GHSA-mwcw-c2x4-8c55

More information

Details

When nanoid is called with a fractional value, there were a number of undesirable effects:

1. in browser and non-secure, the code infinite loops on while (size--)
2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-55565
• https://github.com/ai/nanoid/pull/510
• https://github.com/ai/nanoid
• https://github.com/ai/nanoid/compare/3.3.7...3.3.8
• https://github.com/ai/nanoid/releases/tag/5.0.9

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ai/nanoid (nanoid)

v5.0.9

Compare Source

• Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

このPRによるapi.jsonの差分
差分はありません。
Get diff files from Workflow Page

[github-actions]

Thank you for sending us a great Pull Request! 👍
Please regenerate misskey-js type definitions! 🙏

example:

pnpm run build-misskey-js-with-types

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.