Skip to content

chore(deps): update dependency uuid to v11 [security] - #139

Closed
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-uuid-vulnerability
Closed

chore(deps): update dependency uuid to v11 [security]#139
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-uuid-vulnerability

Conversation

@renovate

@renovate renovate Bot commented May 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
uuid ^3.0.1 → ^11.1.1 age confidence

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code
  • src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
  • src/v6.ts writes buf[offset + i] without bounds validation.
Reproducible PoC
cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4()',()=>v4({},new Uint8Array(8),4)],
  ['v5()',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6()',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Observed:

  • v4() THREW RangeError
  • v5() NO_THROW
  • v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
  170, 170, 170, 170,
   75, 224, 100,  63
]
v6 [
  187, 187, 187, 187,
   31,  19, 185,  64
]
Security impact
  • Primary: integrity/robustness issue (silent partial output).
  • If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
  • In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.
Suggested fix

Add the same guard used by v4()/v1()/v7():

if (offset < 0 || offset + 16 > buf.length) {
  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
}

Apply to:

  • src/v35.ts (covers v3() and v5())
  • src/v6.ts

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

v11.1.1

Compare Source

Bug Fixes

v11.1.0

Compare Source

Features
  • update TS types to allowUint8Array subtypes for buffer option (#​865) (a5231e7)

v11.0.5

Compare Source

Bug Fixes

v11.0.4

Compare Source

Bug Fixes

v11.0.3

Compare Source

Bug Fixes

v11.0.2

Compare Source

Bug Fixes

v11.0.1

Compare Source

Bug Fixes

v11.0.0

Compare Source

⚠ BREAKING CHANGES
  • refactor v1 internal state and options logic (#​780)
  • refactor v7 internal state and options logic, fixes #​764 (#​779)
  • Port to TypeScript, closes #​762 (#​763)
  • update node support matrix (only support node 16-20) (#​750)
Features
Bug Fixes

v10.0.0

Compare Source

⚠ BREAKING CHANGES
  • update node support (drop node@​12, node@​14, add node@​20) (#​750)
Features
Bug Fixes

v9.0.1

Compare Source

build
  • Fix CI to work with Node.js 20.x

v9.0.0

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.2

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.1

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.0

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.2.0

Compare Source

Features
Bug Fixes

v8.1.0

Compare Source

Features
Bug Fixes

v8.0.0

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.3

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.2

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.1

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.0

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v3.4.0

Compare Source

Features

v3.3.3

Compare Source

Bug Fixes
  • no longer run ci tests on node v4
  • upgrade dependencies

v3.3.2

Compare Source

Bug Fixes

v3.3.0

Compare Source

Bug Fixes
Features
  • enforce Conventional Commit style commit messages (#​282) (cc9a182)

3.2.1 (2018-01-16)

Bug Fixes

v3.2.1

Compare Source

Bug Fixes
Features
  • enforce Conventional Commit style commit messages (#​282) (cc9a182)

3.2.1 (2018-01-16)

Bug Fixes

v3.2.0

Compare Source

Bug Fixes
Features
  • enforce Conventional Commit style commit messages (#​282) (cc9a182)

3.2.1 (2018-01-16)

Bug Fixes
  • use msCrypto if available. Fixes [#​24

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented May 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.15%. Comparing base (5c725e6) to head (a0ad6ef).

Additional details and impacted files 
@@           Coverage Diff           @@
##           master     #139   +/-   ##
=======================================
  Coverage   97.15%   97.15%           
=======================================
  Files          19       19           
  Lines        1197     1197           
  Branches      309      309           
=======================================
  Hits         1163     1163           
  Misses         34       34

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from e4ffd35 to a17dd64 Compare May 29, 2026 04:00
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v11 [security] chore(deps): update dependency uuid to v14 [security] May 29, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from a17dd64 to 5ab956f Compare May 31, 2026 03:35
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v14 [security] chore(deps): update dependency uuid to v11 [security] May 31, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 5ab956f to da964f1 Compare June 4, 2026 23:52
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v11 [security] chore(deps): update dependency uuid to v14 [security] Jun 4, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from da964f1 to a297e5b Compare June 6, 2026 19:03
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v14 [security] chore(deps): update dependency uuid to v11 [security] Jun 6, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from a297e5b to 44fa4cd Compare June 13, 2026 03:30
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v11 [security] chore(deps): update dependency uuid to v14 [security] Jun 13, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 44fa4cd to 6a493fa Compare June 14, 2026 15:41
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v14 [security] chore(deps): update dependency uuid to v11 [security] Jun 14, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 6a493fa to c2bf3a5 Compare June 20, 2026 11:39
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v11 [security] chore(deps): update dependency uuid to v14 [security] Jun 20, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from c2bf3a5 to ceaec34 Compare June 21, 2026 11:36
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v14 [security] chore(deps): update dependency uuid to v11 [security] Jun 21, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from ceaec34 to 762cec9 Compare July 15, 2026 23:52
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v11 [security] chore(deps): update dependency uuid to v14 [security] Jul 15, 2026
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v14 [security] chore(deps): update dependency uuid to v11 [security] Jul 29, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch 2 times, most recently from f5f689a to 7a28a08 Compare August 1, 2026 07:13
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v11 [security] chore(deps): update dependency uuid to v14 [security] Aug 1, 2026
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v14 [security] chore(deps): update dependency uuid to v11 [security] Aug 3, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 7a28a08 to 0bf81e4 Compare August 3, 2026 23:47
@socket-security

socket-security Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​uuid@​11.1.110010010088100

View full report

@renovate renovate Bot changed the title chore(deps): update dependency uuid to v11 [security] chore(deps): update dependency uuid to v14 [security] Aug 5, 2026
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 0bf81e4 to 0d8fc50 Compare August 5, 2026 12:36
@renovate
renovate Bot force-pushed the renovate/npm-uuid-vulnerability branch from 0d8fc50 to a0ad6ef Compare August 5, 2026 12:37
@renovate renovate Bot changed the title chore(deps): update dependency uuid to v14 [security] chore(deps): update dependency uuid to v11 [security] Aug 5, 2026
@fengmk2 fengmk2 mentioned this pull request Aug 5, 2026
Merged
@fengmk2

fengmk2 commented Aug 5, 2026

Copy link
Copy Markdown
Member

Closing in favor of #143, which removes the uuid dependency entirely by using Node's built-in crypto.randomUUID().

@fengmk2 fengmk2 closed this Aug 5, 2026
@renovate

renovate Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 11.x releases. But if you manually upgrade to 11.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/npm-uuid-vulnerability branch August 5, 2026 12:54
fengmk2 added a commit that referenced this pull request Aug 5, 2026
@fengmk2
test: use node:crypto randomUUID instead of uuid dependency (#143)
c0d269f 
The uuid package was a devDependency only used to generate temp file
names in tests. Node's built-in crypto.randomUUID() covers this since
Node 14.17 and the package requires Node >= 18, so this drops the
dependency entirely.

This also resolves the CVE-2026-41907 advisory flagged by Renovate,
making #139 obsolete.

Verified with npm run lint and npm run test:js (171 passing, 3 pending).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Removed the unused UUID development dependency.
* Updated temporary test file and directory generation to use Node.js’s
built-in UUID support.

* **Tests**
* Preserved existing archive, extraction, streaming, and security test
behavior while improving temporary path isolation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
fengmk2 pushed a commit that referenced this pull request Aug 5, 2026
@semantic-release-bot
Release 2.1.2
cf41125 
[skip ci]

## <small>2.1.2 (2026-08-05)</small>

* test: use node:crypto randomUUID instead of uuid dependency (#143) ([c0d269f](c0d269f)), closes [#143](#143) [#139](#139)
* ci: add Node.js 26 to the test matrix (#141) ([5c725e6](5c725e6)), closes [#141](#141) [#140](#140)
* fix: resolve symlink chains fully when extracting (#140) ([72a3c84](72a3c84)), closes [#140](#140)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fengmk2