[Bug]: nanoid is a vulnerability in version 5.0.6

[PhongNguyen-Mercatus]

Version

v5

Reanimated Version

v3

Gesture Handler Version

v2

Platforms

iOS, Android

What happened?

nanoid is vulnerability in version 5.0.6

My packages:

• "react-native": "0.73.8",
• "@gorhom/bottom-sheet": "5.0.6",
• "react-native-reanimated": "3.14.0",
• "react-native-gesture-handler": "2.17.1",

Reproduction steps

I have verified the vulnerabilities of packages in project and found nanoid is vulnerability in version 5.0.6 bu run yarn audit

Reproduction sample

https://snack.expo.dev/@gorhom/bottom-sheet---issue-reproduction-template

Relevant log output

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Predictable results in nanoid generation when given          │
│               │ non-integer values                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ nanoid                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.3.8                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @gorhom/bottom-sheet                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @gorhom/bottom-sheet > @gorhom/portal > nanoid               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1101163                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

[haydencrain]

nanoid is a dependency within @gorhom/portal

If you check the usages https://github.com/search?q=repo%3Agorhom%2Freact-native-portal%20nanoid&type=code, it's only being used for Portal keys, so although a vulnerability from a UUID generation perspective, I don't think this is a security issue for how it's being used.

Might be worth posting this as an issue in https://github.com/gorhom/react-native-portal, or even just submitting a PR that bumps the version to be above the patched version