Skip to content

Commit 426945e

Browse files
chore(deps): fix open Dependabot alert(s) - pin uuid to >=14.0.0 via override
Pin all transitive uuid dependencies to >=14.0.0 to address GHSA-w5hq-g745-h8pq (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided). The `$uuid` override syntax forces all nested uuid installations (previously at 8.x, 9.x, 11.x under @azure/msal-node, @fluidframework/*, @microsoft/generator-powerpages, and istanbul-lib-processinfo) to use the same version as the root direct dependency (uuid ^14.0.0 → 14.0.0). Node.js v20.19.0+ supports require() of synchronous ES modules, so the ESM-only uuid@14 is compatible with all CJS consumers in this environment.
1 parent 03542f0 commit 426945e

2 files changed

Lines changed: 1 addition & 152 deletions

File tree

package-lock.json

Lines changed: 0 additions & 152 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1857,6 +1857,7 @@
18571857
"utf-8-validate": "^5.0.9"
18581858
},
18591859
"overrides": {
1860+
"uuid": "$uuid",
18601861
"axios": "1.15.0",
18611862
"basic-ftp": "^5.3.0",
18621863
"tmp": "^0.2.4",

0 commit comments

Comments
 (0)