fix(astro): Update dependency nanoid to v5.1.16 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nanoid	5.1.6 → 5.1.16

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

nanoid: non-secure generators can loop indefinitely with negative size

CVE-2026-67214 / GHSA-28wg-ghj8-5hjv

More information

Details

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-67214
• https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
• https://github.com/ai/nanoid/releases/tag/5.1.16
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
• https://github.com/ai/nanoid/pull/600
• https://github.com/ai/nanoid/pull/601
• https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d
• https://github.com/advisories/GHSA-28wg-ghj8-5hjv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ai/nanoid (nanoid)

v5.1.16

Compare Source

• Fixed forever loop on negative size (by @​spokodev).

v5.1.15

Compare Source

• Fixed random pool corruption on big ID sizes.

v5.1.14

Compare Source

• Fixed npm package size regression.

v5.1.13

Compare Source

• Fixed npm package size regression.

v5.1.12

Compare Source

• Moved to npm Provenance and Staged Publishing.

v5.1.11

Compare Source

• Fixed breaking Nano ID by requesting big ID.

v5.1.10

Compare Source

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

v5.1.9

Compare Source

• Fixed npm package size regression.

v5.1.8

Compare Source

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

v5.1.7

Compare Source

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Aug 27, 2026 7:54pm
swingset	Ready	Preview	Aug 27, 2026 7:54pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6418ef9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9565

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9565

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9565

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9565

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9565

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9565

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9565

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9565

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9565

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9565

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9565

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9565

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9565

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9565

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9565

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9565

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9565

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9565

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9565

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9565

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9565

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9565

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9565

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9565

commit: 6418ef9

[github-actions]

API Changes Report

Generated by Break Check on 2026-08-27T19:56:30.665Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 6418ef9.}