nanoid 5.1.7 → 5.1.8

package/LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright 2017 Andrey Sitnik <andrey@sitnik.ru>
+Copyright 2017 Andrey Sitnik <andrey@sitnik.es>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

package/README.md

@@ -10,12 +10,12 @@ A tiny, secure, URL-friendly, unique string ID generator for JavaScript.
 > “An amazing level of senseless perfectionism,
 > which is simply impossible not to respect.”
 
-* **Small.** 118 bytes (minified and brotlied). No dependencies.
+- **Small.** 118 bytes (minified and brotlied). No dependencies.
   [Size Limit] controls the size.
-* **Safe.** It uses hardware random generator. Can be used in clusters.
-* **Short IDs.** It uses a larger alphabet than UUID (`A-Za-z0-9_-`).
+- **Safe.** It uses hardware random generator. Can be used in clusters.
+- **Short IDs.** It uses a larger alphabet than UUID (`A-Za-z0-9_-`).
   So ID size was reduced from 36 to 21 symbols.
-* **Portable.** Nano ID was ported
+- **Portable.** Nano ID was ported
   to over [20 programming languages](./README.md#other-programming-languages).
 
 ```js
@@ -30,9 +30,8 @@ model.id = nanoid() //=> "V1StGXR8_Z5jdHi6B-myT"
 ---
 
 [online tool]: https://gitpod.io/#https://github.com/ai/nanoid/
-[with Babel]:  https://developer.epages.com/blog/coding/how-to-transpile-node-modules-with-babel-and-webpack-in-a-monorepo/
-[Size Limit]:  https://github.com/ai/size-limit
-
+[with Babel]: https://developer.epages.com/blog/coding/how-to-transpile-node-modules-with-babel-and-webpack-in-a-monorepo/
+[Size Limit]: https://github.com/ai/size-limit
 
 ## Docs
 Read full docs **[here](https://github.com/ai/nanoid#readme)**.

package/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+We supports only the latest version and `3.x` branch.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :x:                |
+| 3.3.x   | :white_check_mark: |
+| 3.0.x   | :x:                |
+| < 3.0   | :x:                |
+
+## Reporting a Vulnerability
+
+To report a security vulnerability, please use the [Tidelift security contact].
+Tidelift will coordinate the fix and disclosure.
+
+[Tidelift security contact]: https://tidelift.com/security

package/index.browser.js

@@ -3,16 +3,34 @@ import { urlAlphabet as scopedUrlAlphabet } from './url-alphabet/index.js'
 export { urlAlphabet } from './url-alphabet/index.js'
 export let random = bytes => crypto.getRandomValues(new Uint8Array(bytes))
 export let customRandom = (alphabet, defaultSize, getRandom) => {
-  let mask = (2 << Math.log2(alphabet.length - 1)) - 1
-  let step = -~((1.6 * mask * defaultSize) / alphabet.length)
+  let safeByteCutoff = 256 - (256 % alphabet.length)
+  if (safeByteCutoff === 256) {
+    let mask = alphabet.length - 1
+    return (size = defaultSize) => {
+      if (!size) return ''
+      let id = ''
+      while (true) {
+        let bytes = getRandom(size)
+        let j = size
+        while (j--) {
+          id += alphabet[bytes[j] & mask]
+          if (id.length >= size) return id
+        }
+      }
+    }
+  }
+  let step = Math.ceil((1.6 * 256 * defaultSize) / safeByteCutoff)
   return (size = defaultSize) => {
+    if (!size) return ''
     let id = ''
     while (true) {
       let bytes = getRandom(step)
-      let j = step | 0
+      let j = step
       while (j--) {
-        id += alphabet[bytes[j] & mask] || ''
-        if (id.length >= size) return id
+        if (bytes[j] < safeByteCutoff) {
+          id += alphabet[bytes[j] % alphabet.length]
+          if (id.length >= size) return id
+        }
       }
     }
   }

package/index.js

@@ -19,8 +19,23 @@ export function random(bytes) {
   return pool.subarray(poolOffset - bytes, poolOffset)
 }
 export function customRandom(alphabet, defaultSize, getRandom) {
-  let mask = (2 << (31 - Math.clz32((alphabet.length - 1) | 1))) - 1
-  let step = Math.ceil((1.6 * mask * defaultSize) / alphabet.length)
+  let safeByteCutoff = 256 - (256 % alphabet.length)
+  if (safeByteCutoff === 256) {
+    let mask = alphabet.length - 1
+    return (size = defaultSize) => {
+      if (!size) return ''
+      let id = ''
+      while (true) {
+        let bytes = getRandom(size)
+        let i = size
+        while (i--) {
+          id += alphabet[bytes[i] & mask]
+          if (id.length >= size) return id
+        }
+      }
+    }
+  }
+  let step = Math.ceil((1.6 * 256 * defaultSize) / safeByteCutoff)
   return (size = defaultSize) => {
     if (!size) return ''
     let id = ''
@@ -28,8 +43,10 @@ export function customRandom(alphabet, defaultSize, getRandom) {
       let bytes = getRandom(step)
       let i = step
       while (i--) {
-        id += alphabet[bytes[i] & mask] || ''
-        if (id.length >= size) return id
+        if (bytes[i] < safeByteCutoff) {
+          id += alphabet[bytes[i] % alphabet.length]
+          if (id.length >= size) return id
+        }
       }
     }
   }

package/package.json

@@ -1,26 +1,32 @@
 {
   "name": "nanoid",
-  "version": "5.1.7",
+  "version": "5.1.8",
   "description": "A tiny (118 bytes), secure URL-friendly unique string ID generator",
   "keywords": [
-    "uuid",
-    "random",
     "id",
-    "url"
+    "random",
+    "url",
+    "uuid"
   ],
-  "type": "module",
-  "engines": {
-    "node": "^18 || >=20"
-  },
+  "license": "MIT",
+  "author": "Andrey Sitnik <andrey@sitnik.es>",
+  "repository": "ai/nanoid",
   "funding": [
     {
       "type": "github",
       "url": "https://github.com/sponsors/ai"
     }
   ],
-  "author": "Andrey Sitnik <andrey@sitnik.ru>",
-  "license": "MIT",
-  "repository": "ai/nanoid",
+  "bin": "./bin/nanoid.js",
+  "type": "module",
+  "sideEffects": false,
+  "browser": {
+    "./index.js": "./index.browser.js"
+  },
+  "types": "./index.d.ts",
+  "react-native": {
+    "./index.js": "./index.browser.js"
+  },
   "exports": {
     ".": {
       "types": "./index.d.ts",
@@ -34,13 +40,7 @@
     },
     "./package.json": "./package.json"
   },
-  "browser": {
-    "./index.js": "./index.browser.js"
-  },
-  "react-native": {
-    "./index.js": "./index.browser.js"
-  },
-  "bin": "./bin/nanoid.js",
-  "sideEffects": false,
-  "types": "./index.d.ts"
+  "engines": {
+    "node": "^18 || >=20"
+  }
 }