Skip to content

Bump uuid from 11.1.1 to 14.0.3 - #183

Merged
cspath1 merged 5 commits into
mainfrom
dependabot/npm_and_yarn/uuid-14.0.3
Oct 21, 2026
Merged

cspath1 merged 5 commits into
mainfrom
dependabot/npm_and_yarn/uuid-14.0.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Bumps uuid from 11.1.1 to 14.0.3.

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

... (truncated)

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.



Note

Overview
Stops depending on the uuid package for extension code and generates identifiers with Node’s built-in randomUUID() from crypto in the LaunchDarkly auth provider (new session IDs and OAuth login state values).

package.json drops uuid from direct dependencies while keeping a resolutions bump to uuid@^14.0.3 for transitive consumers; yarn.lock reflects that version.

Reviewed by Cursor Bugbot for commit 49a694a. Bugbot is set up for automated code reviews on this repo. Configure here.

Bumps [uuid](https://github.com/uuidjs/uuid) from 11.1.1 to 14.0.3.
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.1.1...v14.0.3)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 21, 2026 14:26
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 21, 2026

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit facef01. Configure here.

Comment thread package.json Outdated
Bumps [uuid](https://github.com/uuidjs/uuid) from 11.1.1 to 14.0.3.
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.1.1...v14.0.3)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/uuid-14.0.3 branch from facef01 to b6de9de Compare October 21, 2026 15:42
cspath1 and others added 2 commits October 21, 2026 11:47
…chdarkly/ld-vscode into dependabot/npm_and_yarn/uuid-14.0.3
uuid 14 relies on a global crypto.getRandomValues(), which is not
available on Node 18 (VS Code 1.82-1.89, still allowed by
engines.vscode). Use Node's built-in crypto.randomUUID() instead and
drop uuid as a direct dependency.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cspath1
cspath1 merged commit f8849b8 into main Oct 21, 2026
5 checks passed
@cspath1
cspath1 deleted the dependabot/npm_and_yarn/uuid-14.0.3 branch October 21, 2026 16:40
@cursor cursor Bot mentioned this pull request Oct 22, 2026
1 of 9 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant