Skip to content

chore: update uuid to 11.1.1 - #246

Open
gjvoosten wants to merge 1 commit into
nomcopter:masterfrom
gjvoosten:GH-245-update-uuid
Open

chore: update uuid to 11.1.1#246
gjvoosten wants to merge 1 commit into
nomcopter:masterfrom
gjvoosten:GH-245-update-uuid

Conversation

@gjvoosten

@gjvoosten gjvoosten commented May 4, 2026

Copy link
Copy Markdown

Closes #245

Changes proposed in this pull request:

Updates uuid dependency to 11.1.1.
On master:

$ npm audit -omit=dev
# npm audit report

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix`
node_modules/uuid

1 moderate severity vulnerability

To address all issues, run:
  npm audit fix

On this branch/PR:

$ npm audit --omit=dev
found 0 vulnerabilities

@Lonli-Lokli

Copy link
Copy Markdown
Collaborator

v12 uuid removed CommonJS support uuidjs/uuid#886
uuid is external in our build, not bundled. tsup doesn't bundle dependencies, and uuid is one (libs/.../package.json:46), so our published CJS output does a literal runtime require("uuid"): which will break commonjs users of our package.

@gjvoosten

Copy link
Copy Markdown
Author

@Lonli-Lokli It is my understanding that tsup can be configured to bundle externals, in this case with:

  noExternal: ['uuid'],

added to tsup.config.ts. However, it appears that:

  esbuildPlugins: [esbuildPluginFilePathExtensions()],

interferes with this.
[If I simply remove the plugin, some JS files get different names like chunk-HASH.mjs, so someone needs to investigate what can be done.]

@gjvoosten

Copy link
Copy Markdown
Author

@Lonli-Lokli Alternatively, you could use uuid v11.1.1

@gjvoosten
gjvoosten force-pushed the GH-245-update-uuid branch from 4fcf42d to 496b70c Compare July 28, 2026 14:10
@gjvoosten gjvoosten changed the title chore: update uuid to 14.0.0 chore: update uuid to 11.1.1 Jul 28, 2026
@gjvoosten

Copy link
Copy Markdown
Author

@Lonli-Lokli I rebased the PR on latest master and changed it t update to uuid v11.1.1; should be easy to merge now, right?

@Lonli-Lokli

Copy link
Copy Markdown
Collaborator

@gjvoosten I actually have another branch with deps fixes https://github.com/nomcopter/react-mosaic/tree/code-fixe

After our discussion I find out that commons js was partially broken anyway. This branch has some other improvements which I first need to proper test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update uuid to 11.1.1

2 participants