fix(deps): update dependency nanoid to v3.3.8

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nanoid	3.3.6 -> 3.3.8

---

Release Notes

ai/nanoid (nanoid)

v3.3.8

Compare Source

• Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v3.3.7

Compare Source

• Fixed node16 TypeScript support (by Saadi Myftija).

---

Configuration

📅 Schedule: Branch creation - "* 0-4 * * 3" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

[puLL-Merge] - ai/[email protected]

Description

This PR updates the project dependencies and configuration, primarily focusing on upgrading Node.js versions and adjusting the GitHub Actions workflow. It also includes a minor version bump and a small fix for TypeScript support.

Changes

Changes

1. .github/workflows/test.yml:

   • Added support for Node.js v3 branch
   • Updated Node.js versions: Added 20 and 21, removed 14
   • Changed pnpm version to 8
   • Removed FORCE_COLOR environment variable
   • Added permissions configuration for better security
   • Modified installation command for old Node.js versions

2. CHANGELOG.md:

   • Added entry for version 3.3.7, fixing Node.js 16 TypeScript support

3. package.json:

   • Bumped version to 3.3.7
   • Updated dual-publish dependency to version 4.0.0

4. pnpm-lock.yaml:

   • Updated lockfile to reflect dependency changes
   • Various minor version updates for dependencies

Possible Issues

• The removal of Node.js 14 support might affect users still using that version.
• Changes in the GitHub Actions workflow might require adjustments in other parts of the CI/CD pipeline if they exist.

Security Hotspots

• The addition of the permissions field in the GitHub Actions workflow is a positive security change, limiting the workflow's access to only read contents.

Overall, this PR seems to be a routine maintenance update, improving the project's compatibility with newer Node.js versions and updating dependencies. The changes appear to be well-considered and shouldn't introduce any major issues.

[github-actions]

[puLL-Merge] - ai/[email protected]

Here's my analysis of the pull request:

Description

This PR updates the nanoid library to version 3.3.8, addressing a potential issue where passing a non-integer size to nanoid functions could cause unexpected behavior. The changes include safeguards against pool pollution and infinite loops, as well as updates to dependencies and test cases.

Changes

Changes

1. package.json:

   • Updated version to 3.3.8
   • Updated some dependencies

2. CHANGELOG.md:

   • Added entries for versions 3.3.8 and 3.3.7

3. Source files (index.js, index.browser.js, async/index.js, async/index.browser.js, async/index.native.js, non-secure/index.js):

   • Added bitwise OR operations to ensure size parameter is an integer
   • Modified loop conditions to prevent potential infinite loops

4. Test files:

   • Added new test cases to check for pool pollution and infinite loop prevention
   • Updated existing tests to accommodate new changes

5. Github Actions workflow (test.yml):

   • Updated Node.js versions and other configurations

sequenceDiagram
    participant User
    participant Nanoid
    participant CryptoModule

    User->>Nanoid: Call nanoid(size)
    Nanoid->>Nanoid: Convert size to integer
    Nanoid->>CryptoModule: Request random bytes
    CryptoModule-->>Nanoid: Return random bytes
    Nanoid->>Nanoid: Generate ID
    Nanoid-->>User: Return generated ID

Loading

Possible Issues

• The use of bitwise OR (|=) to convert size to an integer might not be immediately clear to all developers and could benefit from a comment explaining its purpose.

Security Hotspots

No significant security vulnerabilities were introduced in this change. The modifications actually improve the library's robustness against potential misuse.