Skip to content
This repository was archived by the owner on May 28, 2026. It is now read-only.

chore(deps): bump uuid from 11.1.0 to 14.0.0 - #170

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/uuid-14.0.0
Closed

chore(deps): bump uuid from 11.1.0 to 14.0.0#170
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/uuid-14.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps uuid from 11.1.0 to 14.0.0.

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

  • rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

  • update to typescript@5.2 (#887)
  • remove CommonJS support (#886)
  • drop node@16 support (#883)

Features

Bug Fixes

Commits
  • 7c1ea08 chore(main): release 14.0.0 (#926)
  • 3d2c5b0 Merge commit from fork
  • f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
  • 529ef08 chore: upgrade TypeScript and fixup types (#927)
  • 086fd79 chore: update dependencies (#933)
  • dc4ddb8 feat!: drop node@18 support (#934)
  • 0f1f9c9 chore: switch to Biome for parsing and linting (#932)
  • e2879e6 chore: use maintained version of npm-run-all (#930)
  • ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
  • 0423d49 docs: remove obsolete v1 option notes (#915)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 4, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner May 4, 2026 06:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/uuid-14.0.0 branch 3 times, most recently from 9ad8e65 to 8950198 Compare May 16, 2026 02:31
@Almaju Almaju mentioned this pull request May 25, 2026
Closed
4 tasks
@dependabot
chore(deps): bump uuid from 11.1.0 to 14.0.0
3a643a8 
Bumps [uuid](https://github.com/uuidjs/uuid) from 11.1.0 to 14.0.0.
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.1.0...v14.0.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/uuid-14.0.0 branch from 8950198 to 3a643a8 Compare May 25, 2026 22:13
@Almaju
chore(test): fix Jest config to resolve uuid ESM after major bump
4bd7eee 
uuid 12+ ships ESM-only. ts-jest was configured to only transform
.ts/.tsx, and Jest's default transformIgnorePatterns ignores all of
node_modules, so importing uuid from any test suite threw a
SyntaxError on the ESM export.

Extend ts-jest to also handle .js files (with allowJs + module=commonjs
for the test environment only), and exempt uuid from
transformIgnorePatterns so its ESM gets transformed.
@Almaju

Almaju commented May 25, 2026

Copy link
Copy Markdown
Contributor

Closing as not-needed.

The advisory motivating this bump (GHSA-w5hq-g745-h8pq) only affects v3(), v5(), and v6() — missing buffer bounds check when a caller-supplied buffer is provided. This repo only uses v4() (single import in packages/core/src/store.ts), which is not affected.

The bump also requires Jest config changes since uuid 12+ is ESM-only, adding maintenance overhead for no security benefit. If we want uuid 14 later for hygiene, it should be a focused PR that includes a proper Jest ESM migration.

@Almaju Almaju closed this May 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github May 25, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@Almaju Almaju mentioned this pull request May 25, 2026
Closed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/uuid-14.0.0 branch May 25, 2026 22:29
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Almaju