[CSR-0] chore: Bump nanoid from 3.3.16 to 6.0.0

[dependabot]

Bumps nanoid from 3.3.16 to 6.0.0.

Release notes

Sourced from nanoid's releases.

6.0.0

• Made nanoid() and customAlphabet() 4 times faster (by @​orhanayd).
• Removed Node.js 18 and 20 support.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking nanoid by requesting big ID (by @​alanzabihi).

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

5.1.6

• Fixed infinite loop on 0 size for customAlphabet.

5.1.5

• Fixed latest version on npm after 3.x release.

5.1.4

• Fixed latest version on npm after 3.x release.

5.1.3

• Fixed React Native support (by @​steida).

5.1.2

... (truncated)

Changelog

Sourced from nanoid's changelog.

6.0.0

• Made nanoid() and customAlphabet() 4 times faster (by @​orhanayd).
• Removed Node.js 18 and 20 support.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

5.1.6

... (truncated)

Commits

• 4dacb10 Release 6.0.0 version
• 09545ea Simplify CLI for modern Node.js
• 0966ccb Remove obvious comment
• b5a0590 Update docs
• 0501d9c Fix alphabet duplication
• 87f2821 Remove unnecessary import for modern Node.js
• 6a73bf8 Simplfy strings
• 57a250c Simplify code
• 1a97659 Fix formatting
• 1fda937 Remove build files
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: ynahmany. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[maxigimenez]

Security triage — Tier B. Needs a decision, and there is a cheaper fix that closes the same alert.

What and why

nanoid 3.3.16 → 6.0.0, aimed at GHSA-2v37-7h3g-55p8 — HIGH, <3.3.18, patched 3.3.18:

Custom generators can loop indefinitely when size is zero.

That is Dependabot alert 178, Vanta remediateByDate 2026-09-16, 22 days from today.

This PR does not actually close the alert

There are two nanoid requesters in this tree:

requester	range	resolves to on main
packages/cmd (dependencies)	^3.3.8	3.3.16
postcss (dependencies)	^3.3.16	3.3.16 — same hoisted copy

This PR edits only packages/cmd's range to ^6.0.0. Reading the lockfile on this branch:

3.3.16  node_modules/nanoid                dev=true
6.0.0   packages/cmd/node_modules/nanoid   dev=false

The vulnerable 3.3.16 stays in package-lock.json, now serving postcss. So merging this adds a second nanoid major to the tree and leaves the version the advisory names still recorded in the lockfile — which is what the alert is keyed on.

The narrow fix, verified

^3.3.8 and ^3.3.16 both already admit 3.3.18, so no manifest edit is needed at all. On main:

$ npm update nanoid
$ git diff --name-only
package-lock.json

Resulting tree — one copy, patched, and the advisory is gone:

3.3.18  node_modules/nanoid
$ npm audit    # nanoid entry: GONE (8 advisories -> 7)

Lockfile-only, no manifest change, no new major, same result for the compliance clock. nanoid publishes 3.3.18 under the legacy dist-tag, so it is a maintained line, not a dead-end backport.

Why the major is Tier B on its own terms

Independent of the above, 3.3.16 → 6.0.0 would need a decision rather than a merge:

• Major bump of a direct dependencies entry of a published package. @currents/cmd ships to npm, so this changes what consumers install.
• 6.0.0 removes Node.js 18 and 20 support (changelog). @currents/jest and @currents/node-test-reporter both declare "engines": { "node": ">=18.20.4" }. @currents/cmd declares no engines, but the repo's stated support floor is Node 18, and unit-test.yaml runs on Node 20 while types-matrix.yml runs on Node 18. Shipping a dependency that drops Node 18 and 20 while CI type-checks on 18 is a contradiction that should be settled deliberately, not as a side effect of a security bump.
• Collapses nothing today but adds a second major line, since postcss keeps 3.x either way.

Verification

step	result
branch state	merge-base 79293ca = current main, 0 conflicts, not behind
npm update nanoid on main (the alternative)	3.3.18, lockfile-only, advisory cleared
lockfile on this branch	3.3.16 retained at root, 6.0.0 nested under packages/cmd
CI	not run on head 228bf0b — no check runs are attached to this PR

Note the last row: this PR has no CI results at all, so there is no evidence either way about whether @currents/cmd works on nanoid 6. Under this triage's rubric no workflow having run is not green, it is no evidence.

What a human should decide

1. Recommended: close this in favour of a npm update nanoid lockfile refresh to 3.3.18, which closes alert 178 with no manifest change, no major, and no Node-support question. I have not closed it — that is the author's call, and I do not close PRs I did not open.
2. If you want nanoid 6 for its own sake (it is ~4× faster), that is a reasonable but separate change: it needs the Node 18/20 support question answered across @currents/cmd, @currents/jest and @currents/node-test-reporter, and it should not be the vehicle for a HIGH finding with 22 days left.

See also #402, which proposes the same packages/cmd change and is missing its lockfile update.

---

Generated by Claude Code

[twk3]

@dependabot ignore this major version

we need to stay on the 3.x line for now for commonJS

[dependabot]

OK, I won't notify you about version 6.x.x again, unless you re-open this PR.