Bump nanoid from 3.3.4 to 3.3.18 in /fixtures/flight by dependabot[bot] · Pull Request #408 · Rashdamada/react

dependabot · 2026-08-11T13:41:53Z

Bumps nanoid from 3.3.4 to 3.3.18.

Release notes

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

3.3.11

Fixed React Native support.

3.3.10

Fixed React Native support (by @steida).

3.3.9

Reduced npm package size.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

3.3.11

Fixed React Native support.

3.3.10

Fixed React Native support (by @steida).

3.3.9

Reduced npm package size.

3.3.8

Fixed a way to brake Nano ID by passing non-integer size (by @myndzi).

3.3.7

Fixed node16 TypeScript support (by Saadi Myftija).

3.3.6

Fixed package.

3.3.5

Backport funding information.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.4 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.4...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

martinSaad · 2026-08-11T13:42:18Z

⛔ Snyk checks have failed. 437 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (437)
⛔	Open Source Security	28	260	127	22	437 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2026-08-11T13:43:23Z

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

karencapiiro · 2026-08-11T13:50:43Z

Checkmarx One – Scan Summary & Details – e9a4e29c-1d2b-4fd4-82db-76ebeb96a84c

New Issues (546)

Critical: 50 · High: 264 · Medium: 190 · Low: 42

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	CVE-2026-0905	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Insufficient policy enforcement in the Network in Google Chrome prior to 144.0.7559.59 allowed an attacker who obtained a network log file to poten... Attack Vector: NETWORK Attack Complexity: LOW `ID: A3ULyk7NnbwVqY%2BhVnq9%2F8kyzjnnhQ6hardMnE8Gx2Q%3D` Vulnerable Package
2	CVE-2026-0906	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) ... Attack Vector: NETWORK Attack Complexity: LOW `ID: %2Bo3TWDplpTgO1BXvq%2FWtfM47BqUOPgzw%2BGrT4wetoGQ%3D` Vulnerable Package
3	CVE-2026-0907	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Attack Vector: NETWORK Attack Complexity: LOW `ID: 2U7vxDurOTiWdc8el%2B7b3bhfWxAgxQ3h2TKnpwX8sLw%3D` Vulnerable Package
4	CVE-2026-11043	Npm-electron-23.1.2	details Recommended version: 41.10.4 Description: Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to p... Attack Vector: NETWORK Attack Complexity: LOW `ID: 8cdUqPms5a%2Fb6nkJBEI1H%2BmMyYC3mzADwvs3EjoupcY%3D` Vulnerable Package
5	CVE-2026-11095	Npm-electron-23.1.2	details Description: Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend... Attack Vector: NETWORK Attack Complexity: LOW `ID: UWStYMTC%2F%2FgYnY3bBOno3r34UlASsmLzmOA5c2wXZdY%3D` Vulnerable Package
6	CVE-2026-11671	Npm-electron-23.1.2	details Recommended version: 40.10.5 Description: Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a craft... Attack Vector: NETWORK Attack Complexity: LOW `ID: TKLOASzEwwwqjT7lWP%2FCTWDa%2BgtnE7UG46sWjHyuqdk%3D` Vulnerable Package
7	CVE-2026-1525	Npm-undici-5.20.0	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW `ID: p0MlY11YAigbm5UGVe31yuNQqXnnDORuutu%2FOWjv4Eo%3D` Vulnerable Package
8	CVE-2026-1525	Npm-undici-5.22.1	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW `ID: AKeKuvPrdDUU%2BHh6%2FF8uW7VEktwiRQShwi4e34ze0R8%3D` Vulnerable Package
9	CVE-2026-3061	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafte... Attack Vector: NETWORK Attack Complexity: LOW `ID: i%2F%2Fc3nCUCagulsRqQNNaKo0WuqMkXjjdRPOtTx986Xs%3D` Vulnerable Package
10	CVE-2026-3062	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory acce... Attack Vector: NETWORK Attack Complexity: LOW `ID: l1IBPRfF3R0DLE2Bow1BCCZXLQnbxWxNDRiu%2BFrXLUg%3D` Vulnerable Package
11	CVE-2026-33896	Npm-node-forge-0.7.6	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: MiFqY2YBEgzOAK3Uhb%2FE%2F1d9gLCaB1%2FLTQXjVmGIZdc%3D` Vulnerable Package
12	CVE-2026-33896	Npm-node-forge-0.6.33	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: nO2W8QzFSHn5Z6u9uIDdmTC7oIGnsxX8KNNb6R0RBIg%3D` Vulnerable Package
13	CVE-2026-33896	Npm-node-forge-1.3.1	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: BdlNtT6sSkoyO050QIELOkWIXpSXBg3UWr4Hl1DwSjU%3D` Vulnerable Package
14	CVE-2026-33896	Npm-node-forge-0.10.0	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: zA6%2FleD8HqlGm0ZM50jl04NLbMqmb1%2BnkXC5rOyHO2E%3D` Vulnerable Package
15	CVE-2026-33937	Npm-handlebars-4.5.3	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: tJRz9y89U%2FzR95%2FiN4U3KtDN8QpdemVHMOOq9cUGFiU%3D` Vulnerable Package
16	CVE-2026-33937	Npm-handlebars-4.7.7	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: Kzh3PAL4Bo95jWpMPLyr6XYVxqIuX50JW8nDybV9848%3D` Vulnerable Package
17	CVE-2026-33937	Npm-handlebars-4.7.6	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: PciHR3V04ee3ci2JKXfVo57GWy%2B6D5BX6%2FlrwG6RXSk%3D` Vulnerable Package
18	CVE-2026-34775	Npm-electron-23.1.2	details Recommended version: 38.8.6 Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39.... Attack Vector: NETWORK Attack Complexity: LOW `ID: p1e7yiwN7vmvdOdfYEMjw8n2JrPhZ8cZuspg%2FMuAB%2Fw%3D` Vulnerable Package
19	CVE-2026-3545	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox esca... Attack Vector: NETWORK Attack Complexity: LOW `ID: Zd0h9MAWzK8dhd1qifIcHa7Y1Sourtn%2B1S37XKlXjFE%3D` Vulnerable Package
20	CVE-2026-3916	Npm-electron-23.1.2	details Recommended version: 41.0.1 Description: Out-of-bounds Read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a cr... Attack Vector: NETWORK Attack Complexity: LOW `ID: fOx3bGv2MCuErS1y2Z%2FziWDoFMoOQZQuT17zeSkhesc%3D` Vulnerable Package
21	CVE-2026-45623	Npm-postcss-6.0.23	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: r4DVz1R8qC4xFhDM0%2FxWPsfO7UtcXN1jSdUrm1XhhKc%3D` Vulnerable Package
22	CVE-2026-45623	Npm-postcss-5.2.17	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: 59ffIT2LozRut5hdyRgteRc8uuxntd9eJQTW1sRnOzY%3D` Vulnerable Package
23	CVE-2026-45623	Npm-postcss-8.4.35	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: xrToxNiHcxUzsg%2FrMOtaI%2Fv5ZS%2FKCbU41p8h0i0Ah4k%3D` Vulnerable Package
24	CVE-2026-45623	Npm-postcss-8.4.16	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: 4Tz%2Bn%2BxgcALwaizu7tyIBsbRHTSz4F%2F4kxIs6EEWx7o%3D` Vulnerable Package
25	CVE-2026-45623	Npm-postcss-7.0.39	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: IaPSl0qmb3WGkYTicTj6Eotydoz1Kwa%2FuEBCo54Njhc%3D` Vulnerable Package
26	CVE-2026-45623	Npm-postcss-7.0.32	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: Grfo1Cnp1oeKBPDL4%2Fen98W91d8pOIvOVrdq4hFSOJc%3D` Vulnerable Package
27	CVE-2026-45623	Npm-postcss-6.0.9	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: hlJpvgtVCwhX%2F672OeKEQuJ9y%2B7OO5FPhC4gxayo2sI%3D` Vulnerable Package
28	CVE-2026-45623	Npm-postcss-5.2.18	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: iSAUNaubRNzYxt5Tky1hZK9i9TyncbMfWLKLid1Cr2s%3D` Vulnerable Package
29	CVE-2026-45623	Npm-postcss-5.2.15	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: Ljz2VfdSUqdWZhnbOa1lsHcjyVR75rIe6zJsrxkGBYQ%3D` Vulnerable Package
30	CVE-2026-45623	Npm-postcss-6.0.14	details Recommended version: 8.5.12 Description: PostCSS's `PreviousMap` parses the `/# sourceMappingURL=PATH /` comment from any CSS string passed to `process()` and dereferences `PATH` against... Attack Vector: NETWORK Attack Complexity: LOW `ID: S0H9hNxZ3KX%2FRd7UXVor95tTN3cMIVRyHL4%2FqHQJcdI%3D` Vulnerable Package
31	CVE-2026-4800	Npm-lodash-4.17.21	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: %2BTO3uFKrXlH0PqApgBULAXkRsdb%2Ff55qvO5CM2xBJug%3D` Vulnerable Package
32	CVE-2026-4800	Npm-lodash-4.17.20	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: DSad4nJJxGiZRtdW8Yxy63hIfNWu93LYtTK8jxHEHpU%3D` Vulnerable Package
33	CVE-2026-4800	Npm-lodash-4.17.15	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: KYWvkw100snPweeftyqDWjhEyNqbvYpVpdn9cemuUls%3D` Vulnerable Package
34	CVE-2026-4800	Npm-lodash-4.17.4	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: rzJknYA7E2jaEeyGGaYFEckJfRWIf6R%2BAjosVGti4gc%3D` Vulnerable Package
35	CVE-2026-4800	Npm-lodash-4.17.11	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: TpGlH7BTN2QdbPLX26CuEZKIDrj%2B%2FYlKEDJijn699Ns%3D` Vulnerable Package
36	CVE-2026-5288	Npm-electron-23.1.2	details Recommended version: 41.2.0 Description: Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to... Attack Vector: NETWORK Attack Complexity: LOW `ID: Q9pl2emonc9pKEiTGJgecu%2Fip647oHwqxRjSAYG86Lo%3D` Vulnerable Package
37	CVE-2026-53486	Npm-decompress-4.2.1	details Description: When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes th... Attack Vector: NETWORK Attack Complexity: LOW `ID: cbw5V5oVFlORa%2Ftr4Yp9SFB%2BxU7Gbe%2B99KpzRX4GIDg%3D` Vulnerable Package
38	CVE-2026-54466	Npm-websocket-driver-0.7.4	details Recommended version: 0.7.5 Description: The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a s... Attack Vector: NETWORK Attack Complexity: LOW `ID: tv7LUIsbaHKX1v2LGQTJoDMzQG93lQCYD%2BOF1z0e5lA%3D` Vulnerable Package
39	CVE-2026-54466	Npm-websocket-driver-0.7.3	details Recommended version: 0.7.5 Description: The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a s... Attack Vector: NETWORK Attack Complexity: LOW `ID: fSQb9sJI9WE67HTpJ5wO1OE1loPdnEdZOViVH%2BlfXWY%3D` Vulnerable Package
40	CVE-2026-54466	Npm-websocket-driver-0.7.0	details Recommended version: 0.7.5 Description: The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a s... Attack Vector: NETWORK Attack Complexity: LOW `ID: r5yTA74dzLFvwB%2F8Qu6HO5oH18zAcvg7vHHVMcc8dmM%3D` Vulnerable Package

More results are available on the CxOne platform

Fixed Issues (5)

Medium: 5

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CVE-2025-13466~~	Npm-body-parser-1.18.2
	~~CVE-2025-13466~~	Npm-body-parser-1.19.0
	~~CVE-2025-13466~~	Npm-body-parser-1.20.1
	~~CVE-2025-13466~~	Npm-body-parser-1.19.2
	~~CVE-2025-13466~~	Npm-body-parser-1.20.2

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 11, 2026

Navigation Menu

Uh oh!

Bump nanoid from 3.3.4 to 3.3.18 in /fixtures/flight - #408

Bump nanoid from 3.3.4 to 3.3.18 in /fixtures/flight#408
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/fixtures/flight/nanoid-3.3.18

dependabot Bot commented on behalf of github Aug 11, 2026

Uh oh!

martinSaad commented Aug 11, 2026

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

karencapiiro commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 11, 2026

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.11

3.3.10

3.3.9

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.11

3.3.10

3.3.9

3.3.8

3.3.7

3.3.6

3.3.5

Uh oh!

martinSaad commented Aug 11, 2026

⛔ Snyk checks have failed. 437 issues have been found so far.

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

karencapiiro commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants