Fixed on main in bba76b3e: the package now resolves to a fixed version through an override in package.json, and npm audit no longer flags it.
Upgrade uuid to 11.1.1: needs code changes #130
Closedg1tbot opened this dependenciessecurity
uuid (npm) has known vulnerabilities with a fix in 11.1.1, and raising its version alone does not pass this project's checks. Upgrade it to 11.1.1 or later everywhere it is locked, and change the code that depends on it, keeping other changes to what the upgrade needs.
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-w5hq-g745-h8pq | medium | 7.0.3 | 11.1.1 | uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided |
Locked in: .
If the fix needs a major upgrade that breaks the build, change the code that depends on it in the same pull request.
Definition of done
- No lockfile resolves a vulnerable version, and the tests still pass.
Opened by g1t's security updates. Turn them off for this project on its Security page.