Update dependency uuid to v14 [SECURITY] - abandoned by backstage-goalie[bot] · Pull Request #8794 · backstage/community-plugins

backstage-goalie · 2026-04-23T01:42:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
uuid	`^9.0.0` → `^14.0.0`
uuid	`^13.0.0` → `^14.0.0`
uuid	`^11.0.0` → `^14.0.0`
uuid	`^11.1.0` → `^14.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

GHSA-w5hq-g745-h8pq

More information

Details

Summary

v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4, v1, and v7 explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code

src/v35.ts (v3/v5 path) writes buf[offset + i] without bounds validation.
src/v6.ts writes buf[offset + i] without bounds validation.

Reproducible PoC

cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Observed:

v4 THREW RangeError
v5 NO_THROW
v6 NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
  170, 170, 170, 170,
   75, 224, 100,  63
]
v6 [
  187, 187, 187, 187,
   31,  19, 185,  64
]

Security impact

Primary: integrity/robustness issue (silent partial output).
If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.

Suggested fix

Add the same guard used by v4/v1/v7:

if (offset < 0 || offset + 16 > buf.length) {
  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
}

Apply to:

src/v35.ts (covers v3 and v5)
src/v6.ts

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

`v14.0.0`

Compare Source

Security

Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

crypto is now expected to be globally defined (requires node@20+) (#935)
drop node@18 support (#934)
upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

`v13.0.0`

Compare Source

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

`v12.0.0`

Compare Source

⚠ BREAKING CHANGES

update to typescript@5.2 (#887)
remove CommonJS support (#886)
drop node@16 support (#883)

Features

add node@24 to ci matrix (#879) (42b6178)
drop node@16 support (#883) (0f38cf1)
remove CommonJS support (#886) (ae786e2)
update to typescript@5.2 (#887) (c7ee405)

Bug Fixes

improve v4() performance (#894) (5fd974c)
restore node: prefix (#889) (e1f42a3)

`v11.1.0`

Compare Source

Features

update TS types to allowUint8Array subtypes for buffer option (#865) (a5231e7)

`v11.0.5`

Compare Source

Bug Fixes

add TS unit test, pin to typescript@5.0.4 (#860) (24ac2fd)

`v11.0.4`

Compare Source

Bug Fixes

docs: insure -> ensure (#843) (d2a61e1)
exclude tests from published package (#840) (f992ff4)
Test for invalid byte array sizes and ranges in v1(), v4(), and v7() (#845) (e0ee900)

`v11.0.3`

Compare Source

Bug Fixes

apply stricter typing to the v* signatures (#831) (c2d3fed)
export internal uuid types (#833) (341edf4)
remove sourcemaps (#827) (b93ea10)
revert "simplify type for v3 and v5" (#835) (e2dee69)

`v11.0.2`

Compare Source

Bug Fixes

remove wrapper.mjs (#822) (6683ad3)

`v11.0.1`

Compare Source

Bug Fixes

restore package.json#browser field (#817) (ae8f386)

`v11.0.0`

Compare Source

⚠ BREAKING CHANGES

refactor v1 internal state and options logic (#780)
refactor v7 internal state and options logic, fixes #764 (#779)
Port to TypeScript, closes #762 (#763)
update node support matrix (only support node 16-20) (#750)

Features

Port to TypeScript, closes #762 (#763) (1e0f987)
update node support matrix (only support node 16-20) (#750) (883b163)

Bug Fixes

missing v7 expectations in browser spec (#751) (f54a866)
refactor v1 internal state and options logic (#780) (031b3d3)
refactor v7 internal state and options logic, fixes #764 (#779) (9dbd1cd)
remove v4 options default assignment preventing native.randomUUID from being used (#786) (afe6232), closes #763
seq_hi shift for byte 6 (#775) (1d532ca)
tsconfig module type (#778) (7eff835)

`v10.0.0`

Compare Source

⚠ BREAKING CHANGES

update node support (drop node@12, node@14, add node@20) (#750)

Features

support support rfc9562 MAX uuid (new in RFC9562) (#714) (0385cd3)
support rfc9562 v6 uuids (#754) (c4ed13e)
support rfc9562 v7 uuids (#681) (db76a12)
update node support matrix (only support node 16-20) (#750) (883b163)
support rfc9562 v8 uuids (#759) (35a5342)

Bug Fixes

revert "perf: remove superfluous call to toLowerCase (#677)" (#738) (e267b90)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-24T06:07:11Z

    "@mui/styles": "^5.16.6",
    "react-use": "^17.2.4",
-    "uuid": "^11.1.0"
+    "uuid": "^14.0.0"


uuid@^14 lists TypeScript >= 5.4.3 as the minimum supported version, but this workspace is pinned to typescript@~5.3.0 (resolves to 5.3.3 in this workspace yarn.lock). This can cause type-check/build failures; please bump the workspace TypeScript version (or otherwise ensure tsc runs on >=5.4.3) alongside this uuid upgrade.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-24T13:53:17Z

    "knex": "^3.1.0",
    "ollama": "^0.6.0",
-    "uuid": "^11.0.0"
+    "uuid": "^14.0.0"


Upgrading to uuid@^14 raises the runtime requirement to Node.js 20+ (uuid now expects a global crypto). The plugin docs currently state Node.js 18+; please either update the stated support/docs (and/or add an engines.node constraint) or avoid this upgrade if Node 18 support is still required.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

workspaces/tech-insights/plugins/tech-insights-backend/package.json:1

uuid@14 includes breaking runtime/platform expectations (notably Node support changes and reliance on a globally-defined crypto, per upstream release notes). Since this PR updates the dependency range, it should also update the package's supported-runtime signaling (e.g., engines.node and/or CI node matrix) to ensure consumers on unsupported Node versions fail fast during install/CI rather than at runtime. Apply the same adjustment consistently to the other workspaces bumped to ^14.0.0.
workspaces/tech-insights/.changeset/renovate-3deaa6f.md:1
The Changeset marks this as a patch, but upgrading to uuid@14 can imply a breaking change for consumers if it effectively raises the minimum supported Node/runtime requirements (or changes module system expectations). If this package previously supported older Node versions, consider bumping the Changeset to major (or at least minor) to reflect the compatibility impact; alternatively, explicitly constrain engines.node so the change is clearly communicated and enforced.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-24T20:33:11Z

    "react-use": "^17.2.4",
-    "uuid": "^11.1.0"
+    "uuid": "^14.0.0"
  },


uuid@14.0.0 raises the uuid project’s minimum supported TypeScript version to 5.4.3 (per its v14 release notes). This workspace currently pins TypeScript to ~5.3.0 (workspaces/agent-forge/package.json), which can lead to type-check/build failures; please bump the workspace TypeScript version to >=5.4.3 (or align with the repo’s newer TypeScript versions) before landing this update.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Renovate Bot <bot@renovateapp.com>

Copilot

Pull request overview

Copilot reviewed 24 out of 36 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: gaelgoth <gothuey.gael@gmail.com>

gaelgoth · 2026-04-26T13:02:59Z

I removed deprecated @types/uuid in mcp-chat to get CI green. @Lucifergene @christoph-jerolimov @Eswaraiahsapram Ping for quick eyes 👀

backstage-goalie · 2026-04-26T13:34:37Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

backstage-goalie · 2026-04-28T00:30:38Z

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

backstage-service · 2026-05-14T07:10:09Z

👋 Reminder: This Renovate major PR has been open for 21 days.

Please review and merge if the changes look good. If no action is taken, this PR will be labeled force-merge in 21 days.

Copilot AI review requested due to automatic review settings April 23, 2026 01:42

backstage-goalie Bot added dependencies Pull requests that update a dependency file security labels Apr 23, 2026

backstage-goalie Bot requested review from Xantier, kurtaking and punkle as code owners April 23, 2026 01:42

backstage-goalie Bot review requested due to automatic review settings April 23, 2026 01:42

backstage-goalie Bot requested review from a team, AndrienkoAleksandr, Eswaraiahsapram, JessicaJHee, Lucifergene, PatAKnight, Sarabadu, alde, awanlin, christoph-jerolimov, djanickova, dzemanov, gaelgoth, kuangp, lholmquist, sriaradhyula and subbaksh as code owners April 23, 2026 01:42

backstage-service added workspace/announcements Used to tag announcements workspace isses and pull requests workspace/tech-insights Used to tag tech-insights workspace issues and pull requests workspace/shortcuts workspace/keycloak workspace/agent-forge workspace/pingidentity labels Apr 23, 2026

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Copilot AI reviewed Apr 26, 2026

View reviewed changes

christoph-jerolimov approved these changes Apr 26, 2026

View reviewed changes

Copilot AI reviewed Apr 26, 2026

View reviewed changes

Update dependency uuid to v14 [SECURITY]

999b642

Signed-off-by: Renovate Bot <bot@renovateapp.com>

Copilot AI reviewed Apr 26, 2026

View reviewed changes

chore(mcp-chat): Remove deprecated types/uuid dependency

4f4aa4b

Signed-off-by: gaelgoth <gothuey.gael@gmail.com>

gaelgoth approved these changes Apr 26, 2026

View reviewed changes

Sarabadu approved these changes Apr 26, 2026

View reviewed changes

Conversation

backstage-goalie Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Details

Summary

Affected code

Reproducible PoC

Security impact

Suggested fix

Severity

References

Release Notes

Security

⚠ BREAKING CHANGES

⚠ BREAKING CHANGES

Bug Fixes

⚠ BREAKING CHANGES

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

⚠ BREAKING CHANGES

Features

Bug Fixes

⚠ BREAKING CHANGES

Features

Bug Fixes

Configuration

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

backstage-goalie Bot commented Apr 23, 2026 •

edited

Loading