[core] Fix vulnerable nanoid pin by dropping the dependency

.changeset/drop-nanoid-dependency.md

@@ -0,0 +1,5 @@
+---
+"@workflow/core": patch
+---
+
+Security: remove the `nanoid` dependency (pinned at 5.1.6, affected by [GHSA-28wg-ghj8-5hjv](https://github.com/advisories/GHSA-28wg-ghj8-5hjv)). Default hook tokens now come from a built-in copy of the same generator, so tokens and seeded random values stay identical for runs recorded on earlier versions. Upgrading `nanoid` itself would have changed them, because `nanoid@5.1.16` draws a different number of random bytes per id.

packages/core/package.json

@@ -109,7 +109,6 @@
     "debug": "4.4.3",
     "devalue": "6.0.3",
     "ms": "2.1.3",
-    "nanoid": "5.1.6",
     "quickjs-wasi": "3.4.0",
     "seedrandom": "3.0.5",
     "semver": "catalog:",

packages/core/src/abort-consistency.test.ts

@@ -8,13 +8,13 @@
  */
 
 import type { Event, WorkflowRun } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { describe, expect, it, vi } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
 import type { WorkflowSuspension } from './global.js';
 import type { WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import {
   dehydrateWorkflowArguments,
   hydrateWorkflowReturnValue,
@@ -47,9 +47,7 @@ function setupWorkflowContext(events: Event[]): WorkflowOrchestratorContext {
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: () => {},
     promiseQueue: Promise.resolve(),
     pendingDeliveries: 0,

packages/core/src/abort-controller.test.ts

@@ -9,12 +9,12 @@
 import { ReplayDivergenceError } from '@workflow/errors';
 import { withResolvers } from '@workflow/utils';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { describe, expect, it, vi } from 'vitest';
 import { DEFERRED_CHECK_DELAY_MS, EventsConsumer } from './events-consumer.js';
 import type { WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import { dehydrateStepReturnValue } from './serialization.js';
 import { createContext } from './vm/index.js';
 import {
@@ -45,9 +45,7 @@ function setupWorkflowContext(
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     promiseQueue: Promise.resolve(),
   };

packages/core/src/abort-replay-ordering.test.ts

@@ -24,7 +24,6 @@
  */
 
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { describe, expect, it, vi } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
@@ -33,6 +32,7 @@ import {
   type WorkflowOrchestratorContext,
 } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import { createContext } from './vm/index.js';
 import { createCreateAbortController } from './workflow/abort-controller.js';
 
@@ -80,9 +80,7 @@ function setupWorkflowContext(events: Event[]): WorkflowOrchestratorContext {
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     promiseQueue: Promise.resolve(),
     pendingDeliveries: 0,

packages/core/src/async-deserialization-ordering.test.ts

@@ -1,12 +1,12 @@
 import { FatalError } from '@workflow/errors';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
 import { registerSerializationClass } from './class-serialization.js';
 import { EventsConsumer } from './events-consumer.js';
 import { isDeliveryIdle, type WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import {
   dehydrateStepError,
   dehydrateStepReturnValue,
@@ -60,9 +60,7 @@ function setupWorkflowContext(events: Event[]): WorkflowOrchestratorContext {
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     promiseQueue: Promise.resolve(),
     pendingDeliveries: 0,

packages/core/src/delivery-barrier-coverage.test.ts

@@ -52,7 +52,6 @@
 import { WorkflowRuntimeError } from '@workflow/errors';
 import { withResolvers } from '@workflow/utils';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { describe, expect, it, vi } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
@@ -64,6 +63,7 @@ import {
   type WorkflowOrchestratorContext,
 } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import { dehydrateStepReturnValue } from './serialization.js';
 import { createUseStep } from './step.js';
 import { createContext } from './vm/index.js';
@@ -110,9 +110,7 @@ function setupWorkflowContext(events: Event[]): WorkflowOrchestratorContext {
     get mintCount() {
       return mintCount;
     },
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     get promiseQueue() {
       return promiseQueueHolder.current;

packages/core/src/delivery-barrier-dispenser.test.ts

@@ -18,7 +18,6 @@
 import { WorkflowRuntimeError } from '@workflow/errors';
 import { withResolvers } from '@workflow/utils';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { describe, expect, it } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
@@ -29,6 +28,7 @@ import {
   type WorkflowOrchestratorContext,
 } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import { dehydrateStepReturnValue } from './serialization.js';
 import { createUseStep } from './step.js';
 import { createContext } from './vm/index.js';
@@ -82,9 +82,7 @@ function setupWorkflowContext(events: Event[]): WorkflowOrchestratorContext {
     get mintCount() {
       return mintCount;
     },
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: () => {},
     get promiseQueue() {
       return promiseQueueHolder.current;

packages/core/src/race-padded-draw-ordering.test.ts

@@ -28,13 +28,13 @@
 import { WorkflowRuntimeError } from '@workflow/errors';
 import { withResolvers } from '@workflow/utils';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
 import { WorkflowSuspension } from './global.js';
 import { isDeliveryIdle, type WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import { dehydrateStepReturnValue } from './serialization.js';
 import { createUseStep } from './step.js';
 import { createContext } from './vm/index.js';
@@ -72,9 +72,7 @@ function setupWorkflowContext(
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     get promiseQueue() {
       return promiseQueueHolder.current;

packages/core/src/runtime/quickjs-runtime.ts

@@ -44,7 +44,6 @@ import {
   AttributeValidationError,
   validateAttributeEventDataSize,
 } from '@workflow/world/attributes-validation';
-import * as nanoid from 'nanoid';
 import {
   type ExtensionDescriptor,
   JSException,
@@ -55,6 +54,7 @@ import {
 import seedrandom from 'seedrandom';
 import { monotonicFactory } from 'ulid';
 import { runtimeLogger } from '../logger.js';
+import { createSeededNanoid } from '../seeded-nanoid.js';
 import { decompress } from '../serialization/compression.js';
 import type { DecryptionKey } from '../serialization/encryption.js';
 import { decrypt } from '../serialization/encryption.js';
@@ -1589,11 +1589,9 @@ export async function startQuickJSWorkflow(
     return baseRng();
   };
 
-  // Seeded nanoid generator: uses the same nanoid package and seeded PRNG
+  // Seeded nanoid generator: uses the same generator and seeded PRNG
   // as the node:vm engine for consistent token generation.
-  const generateNanoid = nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-    new Uint8Array(size).map(() => 256 * rng())
-  );
+  const generateNanoid = createSeededNanoid(rng);
 
   // Deterministic replay clock, mirroring the node:vm engine (see
   // workflow.ts): the initial value is the run's creation time recovered

packages/core/src/seeded-nanoid.test.ts

@@ -0,0 +1,29 @@
+import seedrandom from 'seedrandom';
+import { describe, expect, it } from 'vitest';
+import { createSeededNanoid } from './seeded-nanoid.js';
+
+describe('createSeededNanoid', () => {
+  // Golden values recorded with nanoid@5.1.6's
+  // customRandom(urlAlphabet, 21, ...), the generator that earlier versions
+  // used for default hook tokens.
+  it('matches the ids and PRNG consumption of nanoid@5.1.6', () => {
+    const rng = seedrandom('wrun_test:seed');
+    const generate = createSeededNanoid(rng);
+
+    expect(generate()).toBe('pVjvQyygUGbIid9mUBIhp');
+    expect(generate()).toBe('mgNKWnMBr9yywfW_syBGT');
+    // The next value workflow code would see from Math.random().
+    expect(rng()).toBe(0.3399971329395688);
+  });
+
+  it('draws 34 values per id', () => {
+    let draws = 0;
+    const generate = createSeededNanoid(() => {
+      draws++;
+      return 0.5;
+    });
+
+    expect(generate()).toHaveLength(21);
+    expect(draws).toBe(34);
+  });
+});

packages/core/src/seeded-nanoid.ts

@@ -0,0 +1,32 @@
+/**
+ * Deterministic generator for default hook tokens inside workflow code.
+ *
+ * The output, and the number of values drawn from `random`, are part of the
+ * replay contract. Every draw advances the run-seeded PRNG that also feeds
+ * `Math.random()` and correlation IDs in workflow code, so a different
+ * consumption pattern changes every ID minted after the first `createHook()`,
+ * and a run recorded on one version diverges when it is replayed on another.
+ *
+ * This reproduces `nanoid@5.1.6`'s `customRandom(urlAlphabet, 21, ...)`
+ * exactly, instead of depending on nanoid, whose `customRandom` changed how
+ * many bytes it requests in 5.1.16. Do not change it.
+ */
+const URL_ALPHABET =
+  'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict';
+const ID_SIZE = 21;
+// nanoid 5.1.6 requests ceil(1.6 * mask * size / alphabet.length) bytes per
+// batch: ceil(1.6 * 63 * 21 / 64) = 34. With a 64-character alphabet every
+// byte maps to a character, so one batch always yields a full id, read from
+// the end of the batch.
+const BYTES_PER_ID = 34;
+
+export function createSeededNanoid(random: () => number): () => string {
+  return () => {
+    const bytes = new Uint8Array(BYTES_PER_ID).map(() => 256 * random());
+    let id = '';
+    for (let i = BYTES_PER_ID - 1; id.length < ID_SIZE; i--) {
+      id += URL_ALPHABET[bytes[i] & 63];
+    }
+    return id;
+  };
+}

packages/core/src/step-delivery-hop-count.test.ts

@@ -26,13 +26,13 @@
 import { WorkflowRuntimeError } from '@workflow/errors';
 import { withResolvers } from '@workflow/utils';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { describe, expect, it, vi } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
 import { WorkflowSuspension } from './global.js';
 import type { WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import {
   dehydrateStepError,
   dehydrateStepReturnValue,
@@ -72,9 +72,7 @@ function setupWorkflowContext(
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     get promiseQueue() {
       return promiseQueueHolder.current;

packages/core/src/step-delivery-ordering.test.ts

@@ -1,13 +1,13 @@
 import { WorkflowRuntimeError } from '@workflow/errors';
 import { withResolvers } from '@workflow/utils';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
 import { WorkflowSuspension } from './global.js';
 import type { WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import { dehydrateStepReturnValue } from './serialization.js';
 import { createUseStep } from './step.js';
 import { createContext } from './vm/index.js';
@@ -121,9 +121,7 @@ function setupWorkflowContext(
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     get promiseQueue() {
       return promiseQueueHolder.current;

packages/core/src/step-hydration-memoization.test.ts

@@ -1,10 +1,10 @@
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { EventsConsumer } from './events-consumer.js';
 import type { WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import { dehydrateStepReturnValue } from './serialization.js';
 import { createUseStep } from './step.js';
 import { createContext } from './vm/index.js';
@@ -45,9 +45,7 @@ function setupWorkflowContext(
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     promiseQueue: Promise.resolve(),
     pendingDeliveries: 0,

packages/core/src/step.test.ts

@@ -1,14 +1,14 @@
 import { FatalError, ReplayDivergenceError } from '@workflow/errors';
 import { withResolvers } from '@workflow/utils';
 import type { Event } from '@workflow/world';
-import * as nanoid from 'nanoid';
 import { monotonicFactory } from 'ulid';
 import { beforeAll, describe, expect, it, vi } from 'vitest';
 import { registerSerializationClass } from './class-serialization.js';
 import { EventsConsumer } from './events-consumer.js';
 import { WorkflowSuspension } from './global.js';
 import type { WorkflowOrchestratorContext } from './private.js';
 import { ReplayPayloadCache } from './replay-payload-cache.js';
+import { createSeededNanoid } from './seeded-nanoid.js';
 import {
   dehydrateStepError,
   dehydrateStepReturnValue,
@@ -60,9 +60,7 @@ function setupWorkflowContext(events: Event[]): WorkflowOrchestratorContext {
     }),
     invocationsQueue: new Map(),
     generateUlid: () => ulid(workflowStartedAt),
-    generateNanoid: nanoid.customRandom(nanoid.urlAlphabet, 21, (size) =>
-      new Uint8Array(size).map(() => 256 * context.globalThis.Math.random())
-    ),
+    generateNanoid: createSeededNanoid(() => context.globalThis.Math.random()),
     onWorkflowError: vi.fn(),
     promiseQueue: Promise.resolve(),
     pendingDeliveries: 0,