Skip to content

Commit 4b47352

Browse files
[compliance] bump uuid dependency in typeid-js (#594)
Fixes jetify-com/typeid-js#21 ## Summary Bump `uuid` from `^10.0.0` to `^11.1.1` to resolve [GHSA-w5hq-g745-h8pq](GHSA-w5hq-g745-h8pq) (missing buffer bounds check in `v3`/`v5`/`v6` when a caller-provided `buf` is used). Bump package version to `1.2.1`. Remove `@types/uuid` from devDependencies since `uuid` v11+ ships its own TypeScript types. No source code changes. `typeid-js` only uses `stringify` and `v7` from uuid. The vulnerable buffer APIs are not called. This is a dependency/audit fix for downstream consumers. ## How was it tested? - `pnpm test` - 109 tests pass - `pnpm run build` - CJS, ESM, and DTS build succeed - `npm audit --omit=dev` - 0 vulnerabilities ## Community Contribution License All community contributions in this pull request are licensed to the project maintainers under the terms of the [Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0). By creating this pull request I represent that I have the right to license the contributions to the project maintainers under the Apache 2 License as stated in the [Community Contribution License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).
1 parent aa36e9c commit 4b47352

2 files changed

Lines changed: 21 additions & 17 deletions

File tree

typeid/typeid-js/package.json

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "typeid-js",
3-
"version": "1.2.0",
3+
"version": "1.2.1",
44
"description": "Official implementation of the TypeID specification in TypeScript. TypeIDs are type-safe, K-sortable, and globally unique identifiers inspired by Stripe IDs",
55
"keywords": [
66
"typeid",
@@ -42,14 +42,13 @@
4242
"@jest/globals": "^29.7.0",
4343
"@tsconfig/strictest": "^2.0.8",
4444
"@types/node": "^20.19.30",
45-
"@types/uuid": "^10.0.0",
4645
"jest": "^29.7.0",
4746
"ts-jest": "^29.4.6",
4847
"ts-node": "^10.9.2",
4948
"tsup": "^8.5.1",
5049
"typescript": "^5.9.3"
5150
},
5251
"dependencies": {
53-
"uuid": "^10.0.0"
52+
"uuid": "^11.1.1"
5453
}
5554
}

typeid/typeid-js/pnpm-lock.yaml

Lines changed: 19 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)