web3-onboard
web3-onboard copied to clipboard
blocknative
Bump nanoid from 4.0.0 to 5.0.9
Bumps nanoid from 4.0.0 to 5.0.9.
Release notes
Sourced from nanoid's releases.
5.0.9
- Fixed a way to break Nano ID by passing non-integer size (by
@myndzi).5.0.8
- Reduced
customAlphabetsize (by@kirillgroshkov).5.0.7
- Fixed Parcel support (by
@WilhelmYakunin).5.0.6
- Fixed React Native support.
Changelog
Sourced from nanoid's changelog.
5.0.9
- Fixed a way to break Nano ID by passing non-integer size (by
@myndzi).5.0.8
- Reduced
customAlphabetsize (by@kirillgroshkov).5.0.7
- Fixed Parcel support (by
@WilhelmYakunin).5.0.6
- Fixed React Native support.
5.0.5
- Make browser’s version faster by increasing size a little (by Samuel Elgozi).
5.0.4
- Fixed CLI docs (by
@ilyaboka).5.0.3
- Fixed CLI docs (by Chris Schmich).
5.0.2
- Fixed
webcryptoimport (by Divyansh Singh).5.0.1
- Fixed Node.js 18 support.
5.0
- Moved Node.js version to Web Crypto API.
- Removed async API since Web Crypto API has only sync version.
- Removed Node.js 14 and 16 support.
4.0.2
- Added link to Github Sponsors.
4.0.1
- Reduced npm package size (by
@HiChen404).4.0
- Removed CommonJS support. Nano ID 4 will work only with ESM applications. We will support 3.x branch with CommonJS for users who can’t migrate to ESM.
- Removed Node.js 10 and Node.js 12 support.
- Reduced npm package size.
3.3.8
- Fixed a way to break Nano ID by passing non-integer size (by
@myndzi).3.3.7
- Fixed
node16TypeScript support (by Saadi Myftija).
... (truncated)
Commits
65a38acRelease 5.0.9 versionb00d120Merge after 3.3.8 release3044cd5Release 3.3.8 versioncdc3edcUpdate size limit4fe3495Update size limitd643045Fix pool pollution, infinite loop (#510)0daa00fAdditional fixes and tests for #508 (#509)313a14eUpdate dependencieseb2db95Fix size limit and linting9da8f60Fix pool pollution, infinite loop (#508)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "Published by a pub.dev verified publisher"){kind=small}
![socket-security[bot] avatar](https://avatars.githubusercontent.com/in/156372?v=4 "Published by a pub.dev verified publisher"){kind=small}
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
| Alert | Package | Note | Source | CI |
|---|---|---|---|---|
| Possible typosquat attack | npm/[email protected] |
| ⚠︎ | |
| Possible typosquat attack | npm/[email protected] |
| ⚠︎ | |
| Possible typosquat attack | npm/[email protected] |
| ⚠︎ | |
| Protestware or potentially unwanted behavior | npm/[email protected] |
| ⚠︎ | |
| Protestware or potentially unwanted behavior | npm/[email protected] |
| ⚠︎ |
Next steps
What is a typosquat?
Package name is similar to other popular packages and may not be the package you want.
Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.
What is protestware?
This package is a joke, parody, or includes undocumented or hidden behavior unrelated to its primary function.
Consider that consuming this package may come along with functionality unrelated to its primary purpose.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore npm/[email protected]@SocketSecurity ignore npm/[email protected]@SocketSecurity ignore npm/[email protected]@SocketSecurity ignore npm/[email protected]