chore(deps): bump uuid to ^11.1.1 - #1671
Conversation
lucasmcdonald3
changed the title
uuid ^10 (material-management, serialize) and ^9 (branch-keystore-node) cannot resolve to a CVE-patched uuid; the fix ships only in 11.x+. Bump all three to ^11.1.1 (patched, still ships CommonJS; 12+ are ESM-only). ESDK-JS only uses v4/validate/version, so this is API-compatible. uuid >=11 bundles .d.ts using TS 5.0 'export type *' syntax, which the repo's pinned TypeScript 4.x cannot parse; add skipLibCheck so the build tolerates the bundled declarations while still type-checking our usage.
4364425 to
93e0c11
Compare
There was a problem hiding this comment.
Pull request overview
This PR updates the uuid dependency across the monorepo packages to ^11.1.1, refreshing the lockfile accordingly, and adjusts the shared TypeScript compiler settings used by all modules.
Changes:
- Bump
uuiddependency ranges to^11.1.1in affected modulepackage.jsonfiles. - Update
package-lock.jsonto resolveuuid@11.1.1(and related lockfile metadata changes). - Enable
skipLibCheckinmodules/tsconfig.settings.json(shared across module builds).
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| package-lock.json | Updates locked uuid version/resolution to 11.1.1 and removes older per-module lock entries. |
| modules/tsconfig.settings.json | Enables skipLibCheck for all module TypeScript builds via the shared settings file. |
| modules/serialize/package.json | Bumps uuid dependency range to ^11.1.1. |
| modules/material-management/package.json | Bumps uuid dependency range to ^11.1.1. |
| modules/branch-keystore-node/package.json | Bumps uuid dependency range to ^11.1.1. |
Comments suppressed due to low confidence (2)
modules/serialize/package.json:28
uuidwas bumped to^11.1.1, but@types/uuidis still pinned to^10.0.0. Keeping the DefinitelyTyped package on a different major can lead to incorrect/incompatible typings being used (or duplicate module declarations) during compilation, especially since the shared tsconfig does not restrict auto-included@types/*packages.
"uuid": "^11.1.1"
},
"devDependencies": {
"@types/uuid": "^10.0.0"
},
modules/material-management/package.json:28
uuidwas bumped to^11.1.1, but@types/uuidremains^10.0.0. A mismatched major version between runtime package and its type package can introduce subtle compile-time inconsistencies (or type declaration duplication).
"uuid": "^11.1.1"
},
"devDependencies": {
"@types/uuid": "^10.0.0"
},
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "esModuleInterop": true, | ||
|
|
||
| "skipLibCheck": true, | ||
|
|
||
| "strict": true, |
There was a problem hiding this comment.
The suggested fix was hallucinated -- the unparseable declarations live in uuid's own bundled type files so restricting the included packages does nothing
This is the easiest way to keep uuid's correct types. The (real, non-hallucinated) alternative is to bump to typescript 5.x which is definitely out of scope
| "inlineSourceMap": true, | ||
| "esModuleInterop": true, | ||
|
|
||
| "skipLibCheck": true, |
There was a problem hiding this comment.
Do we know the implication of this? Are we going to miss any safety nets?
There was a problem hiding this comment.
Check out copilot's comment and my response -- #1671 (comment)
Issue #, if available:
Description of changes:
Bump uuid to ^11.1.1
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Check any applicable: