Update npm package nanoid to v3.3.18 [SECURITY]

[hash-dependencies]

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid	3.3.17 → 3.3.18

---

nanoid: custom generators can loop indefinitely when size is zero

CVE-2026-67213 / GHSA-2v37-7h3g-55p8

More information

Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-67213
• https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
• https://github.com/ai/nanoid/releases/tag/5.1.6
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
• https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b
• https://github.com/ai/nanoid/releases/tag/3.3.17
• https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0
• https://github.com/ai/nanoid/releases/tag/3.3.18
• https://github.com/advisories/GHSA-2v37-7h3g-55p8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ai/nanoid (nanoid)

v3.3.18

Compare Source

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[hash-dependencies]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

error This project's package.json defines "packageManager": "yarn@4.16.0". However the current global version of Yarn is 1.22.22.

Presence of the "packageManager" field indicates that the project is meant to be used with Corepack, a tool included by default with all official Node.js distributions starting from 16.9 and 14.19.
Corepack must currently be enabled by running corepack enable in your terminal. For more information, check out https://yarnpkg.com/corepack.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Error		Aug 14, 2026 7:28pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	Aug 14, 2026 7:28pm
petrinaut	Skipped		Aug 14, 2026 7:28pm

[cursor]

PR Summary

^{Cursor Bugbot is generating a summary for commit 078b80c. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 078b80c. Configure here.}

[cursor]

Lockfile omits security bump

High Severity

package.json bumps nanoid to 3.3.18, but yarn.lock still pins @apps/hash-api to nanoid@3.3.17 and keeps an exact nanoid@npm:3.3.17 resolution. With Yarn 4 immutable installs, CI fails on the mismatch; otherwise the vulnerable direct dependency remains installed, so the GHSA-2v37-7h3g-55p8 fix does not take effect for hash-api.

 

^{Reviewed by Cursor Bugbot for commit 078b80c. Configure here.}

[claude]

Closing in favour of #9231, which carries the same bump plus the regenerated lockfile.

This PR changed only apps/hash-api/package.json. Renovate could not regenerate yarn.lock — per its own artifact-update comment above, its runner has global Yarn 1.22.22 while this repo declares packageManager: yarn@4.16.0. Because the nanoid pin is exact, yarn.lock kept a separate nanoid@npm:3.3.17 entry, so the manifest-only change left the vulnerable version resolved and GHSA-2v37-7h3g-55p8 (<3.3.18) unresolved.

#9231 bumps the pin and regenerates the lockfile with Yarn 4, removing the nanoid@npm:3.3.17 entry.

[hash-dependencies]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (3.3.18). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.