shortid is deprecated

[wengtad]

Hi, thanks for this project. I am realized shortid is listed deprecated in their package.

shortid is deprecated, because the architecture is unsafe.

They do recommend using Nano ID and the bundle size is smaller according to Bundlephobia.
I am not sure will it have any impact if change from shortid to any other similar package.

[SamuelQZQ]

@tehkapa I'd like to be assigned to this task.

[matteovivona]

@SamuelQZQ okay. let's be very careful if Nano ID works the same way as Short ID

[SamuelQZQ]

@tehkapa The shortid uses a dynamic length id. But the nanoid use a fixed-length id. So, after migrate to nanoid, the question is, what length should we use? I think 9 or 10 is enough. Here is a collision calculator: Nano ID Collision Calculator

[SamuelQZQ]

@tehkapa
Finally, I found that the nanoid above 3.0 met a bug in Create React App, which only fixed after Create React App 4.0.
See: nanoid doc about Create React App.

We have two choices:

• Use the nanoid 2.0 first, and upgrade it to the latest version after we upgrade the react-scripts.
• Keep using shortid, migrate to nanoid after we upgrade the react-scripts.

Personally prefer the latter.

[matteovivona]

damn these updates are getting more and more complicated. @HospitalRun/core-contributors what do you think?

[blestab]

• Keep using shortid, migrate to nanoid after we upgrade the react-scripts.

Sounds like a plan