From f20d5766bb281db8b7ca1b6c5de779ff4d7baae2 Mon Sep 17 00:00:00 2001 From: Alex Yang Date: Thu, 13 Aug 2026 22:50:06 -0400 Subject: [PATCH] chore(deps): upgrade nanoid to ^5.1.16 nanoid 5.x < 5.1.16 is affected by CVE-2026-67214 / GHSA-28wg-ghj8-5hjv (non-secure generators can loop indefinitely with negative size). @workflow/core's exact 5.1.6 pin holds every downstream app on the vulnerable version and forces app-level overrides. The caret range also lets nanoid dedupe with other 5.x consumers in the host app (same reasoning as #3498). Workbench apps bumped alongside so the workspace stays on a single copy. --- .changeset/bump-nanoid-5-1-16.md | 5 +++++ packages/core/package.json | 2 +- pnpm-lock.yaml | 18 +++++++++--------- workbench/nextjs-turbopack/package.json | 2 +- workbench/nextjs-webpack/package.json | 2 +- 5 files changed, 17 insertions(+), 12 deletions(-) create mode 100644 .changeset/bump-nanoid-5-1-16.md diff --git a/.changeset/bump-nanoid-5-1-16.md b/.changeset/bump-nanoid-5-1-16.md new file mode 100644 index 0000000000..84b2294070 --- /dev/null +++ b/.changeset/bump-nanoid-5-1-16.md @@ -0,0 +1,5 @@ +--- +'@workflow/core': patch +--- + +Update nanoid to ^5.1.16 — closes CVE-2026-67214 (5.x < 5.1.16), and the caret range lets the dependency dedupe with other nanoid 5.x consumers in the host app instead of forcing a second copy. diff --git a/packages/core/package.json b/packages/core/package.json index c1f9a07993..30fd321459 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -104,7 +104,7 @@ "debug": "4.4.3", "devalue": "5.9.0", "ms": "2.1.3", - "nanoid": "5.1.6", + "nanoid": "^5.1.16", "quickjs-wasi": "3.4.0", "seedrandom": "3.0.5", "semver": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 392d99262c..c2e369fabf 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -553,8 +553,8 @@ importers: specifier: 2.1.3 version: 2.1.3 nanoid: - specifier: 5.1.6 - version: 5.1.6 + specifier: ^5.1.16 + version: 5.1.16 quickjs-wasi: specifier: 3.4.0 version: 3.4.0 @@ -2021,8 +2021,8 @@ importers: specifier: ^12.29.0 version: 12.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7) nanoid: - specifier: 5.1.6 - version: 5.1.6 + specifier: ^5.1.16 + version: 5.1.16 next: specifier: 16.2.11 version: 16.2.11(@opentelemetry/api@1.9.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) @@ -2145,8 +2145,8 @@ importers: specifier: ^12.29.0 version: 12.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7) nanoid: - specifier: 5.1.6 - version: 5.1.6 + specifier: ^5.1.16 + version: 5.1.16 next: specifier: 16.2.11 version: 16.2.11(@opentelemetry/api@1.9.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) @@ -14005,8 +14005,8 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true - nanoid@5.1.6: - resolution: {integrity: sha512-c7+7RQ+dMB5dPwwCp4ee1/iV/q2P6aK1mTZcfr1BTuVlyW9hJYiMPybJCcnBlQtuSmTIWNeazm/zqNoZSSElBg==} + nanoid@5.1.16: + resolution: {integrity: sha512-kVrnsrJqMR8+oLJnGEmSWw9BivK5mt7H3FZatVRjrc5wGqFYuBxX1yG7+A7Gi5AefkX6t/oCkizcQgpu0cY1dQ==} engines: {node: ^18 || >=20} hasBin: true @@ -31484,7 +31484,7 @@ snapshots: nanoid@3.3.16: {} - nanoid@5.1.6: {} + nanoid@5.1.16: {} nanotar@0.3.0: {} diff --git a/workbench/nextjs-turbopack/package.json b/workbench/nextjs-turbopack/package.json index 3e1c5eec33..8f991434a3 100644 --- a/workbench/nextjs-turbopack/package.json +++ b/workbench/nextjs-turbopack/package.json @@ -33,7 +33,7 @@ "lucide-react": "0.555.0", "mixpart": "0.0.4", "motion": "^12.29.0", - "nanoid": "5.1.6", + "nanoid": "^5.1.16", "next": "16.2.11", "openai": "6.9.1", "radix-ui": "1.4.3", diff --git a/workbench/nextjs-webpack/package.json b/workbench/nextjs-webpack/package.json index d1b020ad43..9ae88efb6c 100644 --- a/workbench/nextjs-webpack/package.json +++ b/workbench/nextjs-webpack/package.json @@ -33,7 +33,7 @@ "lucide-react": "0.555.0", "mixpart": "0.0.4", "motion": "^12.29.0", - "nanoid": "5.1.6", + "nanoid": "^5.1.16", "next": "16.2.11", "openai": "6.9.1", "radix-ui": "1.4.3",