Skip to content

chore(astro): Update dependency nanoid to v5.1.16 [SECURITY] - #9604

Draft
manovotny wants to merge 1 commit into
mainfrom
manovotny/astro-bump-nanoid
Draft

chore(astro): Update dependency nanoid to v5.1.16 [SECURITY]#9604
manovotny wants to merge 1 commit into
mainfrom
manovotny/astro-bump-nanoid

Conversation

@manovotny

Copy link
Copy Markdown
Contributor

Description

Bumps @clerk/astro's pinned nanoid from 5.1.6 to 5.1.16, which resolves GHSA-28wg-ghj8-5hjv (high: non-secure generators can loop indefinitely with a negative size). Practical exposure is low, but the pin means every fresh install of @clerk/astro — including each new Astro quickstart — starts with a high-severity npm audit warning.

Found while bumping clerk/clerk-astro-quickstart#20 to @clerk/astro@4 for DOCS-11934.

Test: pnpm --filter @clerk/astro... build passes on the bump; the only runtime change is nanoid's patch delta.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

🤖 Generated with Claude Code

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercel Bot commented Aug 28, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview Aug 28, 2026 10:17pm
swingset Ready Ready Preview Aug 28, 2026 10:17pm

Request Review

@changeset-bot

changeset-bot Bot commented Aug 28, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ecf8b33

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@clerk/astro Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-new Bot commented Aug 28, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9604

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9604

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9604

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9604

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9604

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9604

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9604

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9604

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9604

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9604

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9604

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9604

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9604

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9604

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9604

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9604

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9604

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9604

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9604

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9604

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9604

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9604

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9604

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9604

commit: ecf8b33

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant