chore(deps): bump nanoid from 5.1.5 to 5.1.16

[dependabot]

Bumps nanoid from 5.1.5 to 5.1.16.

Release notes

Sourced from nanoid's releases.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking nanoid by requesting big ID (by @​alanzabihi).

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

5.1.6

• Fixed infinite loop on 0 size for customAlphabet.

Changelog

Sourced from nanoid's changelog.

5.1.16

• Fixed forever loop on negative size (by @​spokodev).

5.1.15

• Fixed random pool corruption on big ID sizes.

5.1.14

• Fixed npm package size regression.

5.1.13

• Fixed npm package size regression.

5.1.12

• Moved to npm Provenance and Staged Publishing.

5.1.11

• Fixed breaking Nano ID by requesting big ID.

5.1.10

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

5.1.9

• Fixed npm package size regression.

5.1.8

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

5.1.7

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

5.1.6

• Fixed infinite loop on 0 size for customAlphabet.

Commits

• 6ccc67b Release 5.1.16 version
• 6de05d7 fix(non-secure): clamp negative size with a smaller guard (#600)
• 3925903 Update dependencies
• 0b69554 Release 5.1.15 version
• 333c5a0 Backport changelog changes for 3.x
• 266eb63 Remove debug code
• a6a94d3 Do not allow to pollute pool
• 93fe197 Reduce ID size
• e4b7a9a Release 5.1.14 version
• 6bf3469 Update release action
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Patch-level dependency bump with bugfix releases for ID generation edge cases; no app code changes, typical Dependabot risk profile.

Overview
Bumps the direct nanoid dependency from 5.1.5 to 5.1.16 in package.json, with pnpm-lock.yaml refreshed to match.

The lockfile also shifts several transitive packages (notably AWS SDK / Smithy optional stacks, OpenTelemetry semantic-conventions, protobufjs, and nested nanoid versions used by PostCSS) as a side effect of the install graph update—no application source changes.

^{Reviewed by Cursor Bugbot for commit 28a40ec. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
langfuse-docs	Ready	Preview	Aug 9, 2026 5:29pm

[claude]

LGTM — routine patch-level dependency bump.

Reviewed the nanoid version bump (5.1.5 → 5.1.16) in package.json and the corresponding pnpm-lock.yaml update. Checked the incidental transitive lockfile churn (AWS SDK/Smithy, OpenTelemetry semantic-conventions, protobufjs) — these are just resolver side effects of the install graph refresh, no application code changed.

Extended reasoning...

Overview

This PR is an automated Dependabot dependency bump of nanoid from 5.1.5 to 5.1.16 (patch releases only). The only files changed are package.json (version specifier) and pnpm-lock.yaml (lockfile refresh). No application source files were touched.

Security risks

None identified. The nanoid changelog entries between these versions are all bugfixes (infinite loop on negative/zero size, random pool corruption on large ID sizes, npm package size regressions) — no breaking API changes and no new attack surface. The incidental transitive bumps in the lockfile (AWS SDK/Smithy optional deps, OpenTelemetry semantic-conventions, protobufjs helpers) are resolver-driven and not directly used by this repo's application code.

Level of scrutiny

Low. This is a mechanical dependency version bump with no logic changes, following the standard Dependabot auto-merge pattern (the PR carries the auto-merge label). Nanoid is used internally by transitive tooling (e.g., PostCSS) rather than directly wired into security-sensitive code paths in this docs site.

Other factors

No CODEOWNER-restricted paths are touched, no CI-relevant config changed, and the diff is fully mechanical (version specifier + lockfile). This matches the profile of changes that should be approved without requiring human review.