Commit 4b47352
authored
[compliance] bump uuid dependency in typeid-js (#594)
Fixes jetify-com/typeid-js#21
## Summary
Bump `uuid` from `^10.0.0` to `^11.1.1` to resolve
[GHSA-w5hq-g745-h8pq](GHSA-w5hq-g745-h8pq)
(missing buffer bounds check in `v3`/`v5`/`v6` when a caller-provided
`buf` is used). Bump package version to `1.2.1`.
Remove `@types/uuid` from devDependencies since `uuid` v11+ ships its
own TypeScript types.
No source code changes. `typeid-js` only uses `stringify` and `v7` from
uuid. The vulnerable buffer APIs are not called. This is a
dependency/audit fix for downstream consumers.
## How was it tested?
- `pnpm test` - 109 tests pass
- `pnpm run build` - CJS, ESM, and DTS build succeed
- `npm audit --omit=dev` - 0 vulnerabilities
## Community Contribution License
All community contributions in this pull request are licensed to the
project maintainers under the terms of the [Apache 2
License](https://www.apache.org/licenses/LICENSE-2.0).
By creating this pull request I represent that I have the right to
license the contributions to the project maintainers under the Apache 2
License as stated in the [Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).1 parent aa36e9c commit 4b47352
2 files changed
Lines changed: 21 additions & 17 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| |||
42 | 42 | | |
43 | 43 | | |
44 | 44 | | |
45 | | - | |
46 | 45 | | |
47 | 46 | | |
48 | 47 | | |
49 | 48 | | |
50 | 49 | | |
51 | 50 | | |
52 | 51 | | |
53 | | - | |
| 52 | + | |
54 | 53 | | |
55 | 54 | | |
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments