chore(deps): upgrade nanoid to ^5.1.16 by himself65 · Pull Request #3545 · vercel/workflow

himself65 · 2026-08-14T02:50:26Z

What

packages/core: nanoid: 5.1.6 → ^5.1.16 (+ the two workbench apps, so the workspace stays on a single copy). Changeset: patch for @workflow/core.

Why

nanoid >= 4.0.0, < 5.1.16 is affected by CVE-2026-67214 / GHSA-28wg-ghj8-5hjv (non-secure generators can loop indefinitely with a negative size). The fixed 5.1.16 has been out since June 24.
@workflow/core is currently the only path through which nanoid 5.x enters a consuming app, so the exact 5.1.6 pin holds every downstream on the vulnerable version — apps have to carry a nanoid@^5.0.0: ^5.1.16 override/resolution to close the advisory.
Caret rather than a new exact pin, for the same reason as [deps] Dedupe zod and undici by publishing caret ranges #3498: an exact pin can only ever match one version, so any other 5.x consumer in the host app gets a second copy.

Lockfile regenerated with pnpm@10.20.0 install --lockfile-only — the only movement is nanoid 5.1.6 → 5.1.16.

Backport

main is the 5.0 beta line — could this also be backported to the 4.x release line (like #2653)? That's where consuming apps would actually pick the fix up today.

🤖 Generated with Claude Code

nanoid 5.x < 5.1.16 is affected by CVE-2026-67214 / GHSA-28wg-ghj8-5hjv (non-secure generators can loop indefinitely with negative size). @workflow/core's exact 5.1.6 pin holds every downstream app on the vulnerable version and forces app-level overrides. The caret range also lets nanoid dedupe with other 5.x consumers in the host app (same reasoning as vercel#3498). Workbench apps bumped alongside so the workspace stays on a single copy.

changeset-bot · 2026-08-14T02:50:38Z

🦋 Changeset detected

Latest commit: f20d576

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages

Name	Type
@workflow/core	Patch
@workflow/builders	Patch
@workflow/cli	Patch
@workflow/next	Patch
@workflow/nitro	Patch
@workflow/vitest	Patch
@workflow/web-shared	Patch
@workflow/web	Patch
workflow	Patch
@workflow/world-testing	Patch
@workflow/astro	Patch
@workflow/nest	Patch
@workflow/rollup	Patch
@workflow/sveltekit	Patch
@workflow/vite	Patch
@workflow/nuxt	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-08-14T02:50:46Z

@himself65 is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

socket-security · 2026-08-14T02:52:16Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/nanoid@5.1.16

View full report

VaguelySerious

Workflow SDK doesn't pass user code into nanoid and is thus unaffected by CVE-2026-67214. Will update package in the next update sweep

Closes #3842. ## What `@workflow/core` pins `nanoid` exactly at `5.1.6`, which is in the vulnerable range of [GHSA-28wg-ghj8-5hjv](GHSA-28wg-ghj8-5hjv) (high, `>=4.0.0 <5.1.16`). Because the pin is exact, apps can only move off it with an `overrides`/`resolutions` entry. This PR removes the dependency instead of bumping it. ## Why not just bump nanoid? Core uses nanoid only to build the seeded generator for default hook tokens: `customRandom(urlAlphabet, 21, bytes from the run-seeded PRNG)`. In 5.1.16, `customRandom` requests 21 bytes per id instead of 34. For the same seed, that changes both the hook token and every seeded value drawn after it (`Math.random()` inside the workflow, later tokens): | seed `wrun_test:seed` | 1st token | 2nd token | next `Math.random()` | |---|---|---|---| | nanoid 5.1.6 | `pVjvQyygUGbIid9mUBIhp` | `mgNKWnMBr9yywfW_syBGT` | `0.3399…` | | nanoid 5.1.16 | `d9mUBIhphoZLwZ1T1ma-k` | `jdT3d6rupVjvQyygUGbIi` | `0.1769…` | A run recorded before the upgrade and replayed after it would diverge. On `stable`, a plain bump failed the `hook-sleep-interaction` replay tests with `ReplayDivergenceError` (see #4336's history). The same applies to users who add a `nanoid` override today. ## Changes - `packages/core/src/seeded-nanoid.ts` reproduces nanoid 5.1.6's `customRandom(urlAlphabet, 21, ...)` exactly: 34 draws per id, read from the end of the batch. - `seeded-nanoid.test.ts` pins the recorded 5.1.6 output and PRNG position, so any change to the draw pattern fails a test. - The node:vm engine (`workflow.ts`), the QuickJS engine (`runtime/quickjs-runtime.ts`) and the test helpers all use it. - `nanoid` is removed from `@workflow/core`'s dependencies. - The two private Next.js workbenches, which use nanoid directly, are bumped to 5.1.16. - Changeset: patch for `@workflow/core`, worded as a security fix so the backport check picks it up. ## Verification - `pnpm --filter @workflow/core test` passes (3070 tests on current `main`), and `typecheck` passes. - Installing this PR's workflow-tarballs build and running `npm audit --omit=dev` reports 0 vulnerabilities, with no `nanoid` in the tree. ## Related - #4336 carries the same change for `stable` (4.x), plus the undici 7.29.0 backport from #3315. - #3545 is the community PR for the plain bump. It has the replay issue described above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Pranay Prakash <1797812+pranaygp@users.noreply.github.com> Co-authored-by: Peter Wielander <peter.wielander@vercel.com>

Closes #3842. `@workflow/core` pins `nanoid` exactly at `5.1.6`, which is in the vulnerable range of [GHSA-28wg-ghj8-5hjv](GHSA-28wg-ghj8-5hjv) (high, `>=4.0.0 <5.1.16`). Because the pin is exact, apps can only move off it with an `overrides`/`resolutions` entry. This PR removes the dependency instead of bumping it. Core uses nanoid only to build the seeded generator for default hook tokens: `customRandom(urlAlphabet, 21, bytes from the run-seeded PRNG)`. In 5.1.16, `customRandom` requests 21 bytes per id instead of 34. For the same seed, that changes both the hook token and every seeded value drawn after it (`Math.random()` inside the workflow, later tokens): | seed `wrun_test:seed` | 1st token | 2nd token | next `Math.random()` | |---|---|---|---| | nanoid 5.1.6 | `pVjvQyygUGbIid9mUBIhp` | `mgNKWnMBr9yywfW_syBGT` | `0.3399…` | | nanoid 5.1.16 | `d9mUBIhphoZLwZ1T1ma-k` | `jdT3d6rupVjvQyygUGbIi` | `0.1769…` | A run recorded before the upgrade and replayed after it would diverge. On `stable`, a plain bump failed the `hook-sleep-interaction` replay tests with `ReplayDivergenceError` (see #4336's history). The same applies to users who add a `nanoid` override today. - `packages/core/src/seeded-nanoid.ts` reproduces nanoid 5.1.6's `customRandom(urlAlphabet, 21, ...)` exactly: 34 draws per id, read from the end of the batch. - `seeded-nanoid.test.ts` pins the recorded 5.1.6 output and PRNG position, so any change to the draw pattern fails a test. - The node:vm engine (`workflow.ts`), the QuickJS engine (`runtime/quickjs-runtime.ts`) and the test helpers all use it. - `nanoid` is removed from `@workflow/core`'s dependencies. - The two private Next.js workbenches, which use nanoid directly, are bumped to 5.1.16. - Changeset: patch for `@workflow/core`, worded as a security fix so the backport check picks it up. - `pnpm --filter @workflow/core test` passes (3070 tests on current `main`), and `typecheck` passes. - Installing this PR's workflow-tarballs build and running `npm audit --omit=dev` reports 0 vulnerabilities, with no `nanoid` in the tree. - #4336 carries the same change for `stable` (4.x), plus the undici 7.29.0 backport from #3315. - #3545 is the community PR for the plain bump. It has the replay issue described above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Pranay Prakash <1797812+pranaygp@users.noreply.github.com> Co-authored-by: Peter Wielander <peter.wielander@vercel.com> Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>

himself65 requested a review from a team as a code owner August 14, 2026 02:50

VaguelySerious reviewed Aug 14, 2026

View reviewed changes

This was referenced Sep 23, 2026

[core] Fix vulnerable nanoid pin by dropping the dependency #4335

Merged

Hardcoded dep version make it hard to patch vulnerabilities #3842

Closed

Navigation Menu

Repository navigation

chore(deps): upgrade nanoid to ^5.1.16 - #3545

chore(deps): upgrade nanoid to ^5.1.16#3545
himself65 wants to merge 1 commit into
vercel:mainfrom
himself65:chore/bump-nanoid-5.1.16

himself65 commented Aug 14, 2026

Uh oh!

changeset-bot Bot commented Aug 14, 2026

Uh oh!

vercel Bot commented Aug 14, 2026

Uh oh!

socket-security Bot commented Aug 14, 2026

Uh oh!

VaguelySerious left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

himself65 commented Aug 14, 2026

What

Why

Backport

Uh oh!

changeset-bot Bot commented Aug 14, 2026

🦋 Changeset detected

Uh oh!

vercel Bot commented Aug 14, 2026

Uh oh!

socket-security Bot commented Aug 14, 2026

Uh oh!

VaguelySerious left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants