chore(deps): bump uuid from 11.1.1 to 14.0.1 - #15131
Conversation
dependabot
Bot
added
dependencies
github-actions
Bot
added
DEV: renderers
🔵 Review postedLast updated: 2026-08-02 21:16 UTC |
Build Artifacts
Smoke test screenshot |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15131 — uuid 11.1.1 → 14.0.1 in kolibri/plugins/epub_viewer (production dependency, multi-major bump). CI passing.
Effectively a catch-up bump: packages/kolibri-common and packages/kolibri-sandbox already declare ^14.0.1 on develop, so uuid@14 is already built, bundled and tested here — this PR ends a state where two uuid majors were shipping into bundles that load side by side.
Breaking changes across 12 → 14:
- 12.0.0 — CommonJS support removed; node@16 dropped.
- 13.0.0 — browser exports are now the default.
- 14.0.0 —
cryptomust be globally defined (node@20+); node@18 dropped; min TypeScript 5.4.3.
Security: 14.0.0 (backported to 13.0.1) fixes GHSA-w5hq-g745-h8pq — v3()/v5()/v6() did not bounds-check a caller-supplied buf/offset, allowing out-of-bounds writes. Not reachable here: the repo only calls v4() (no args) and validate().
Peer dependencies: none changed.
Compatibility — no code changes required:
- CommonJS removal is a non-issue for the bundle; swc-loader transpiles node_modules against
browserslist-config-kolibri, anduseCustomThemes.spec.jsexercises this import path under Jest with tests passing. - node@20+: root
package.jsondeclares"engines": {"node": "^20.19.0"}, volta pins 20.19.3. - Browser
crypto: browserslist floor is Chrome 49 / Safari 11.1, well pastcrypto.getRandomValues.crypto.randomUUIDis absent on Kolibri's plain-HTTP LAN origins, but uuid guards that path and falls back.
Lockfile: minimal — one resolution repointed, orphaned uuid@11.1.1 dropped, no new packages. Only extra churn is a transitive electron-to-chromium 1.5.395 → 1.5.396 refresh. Dependabot's "modifies prepare script" banner is noise: prepare doesn't run for registry tarball installs, and pnpm 10 gates lifecycle scripts via onlyBuiltDependencies (uuid isn't listed).
suggestion — uuid is now hand-pinned as ^14.0.1 in three manifests (kolibri/plugins/epub_viewer/package.json:21, packages/kolibri-common/package.json:30, packages/kolibri-sandbox/package.json:42). This PR exists because they drifted. The repo already uses pnpm catalogs for exactly this ("vue": "catalog:" two lines below); moving uuid into the catalog would collapse future bumps to one PR. Not required for this merge.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15131 — uuid ^11.1.1 → ^14.0.1 in kolibri/plugins/epub_viewer/package.json. Major bump (three majors), production dependency. CI passing.
Breaking changes across v12–v14, none affecting this repo:
- v12: CommonJS build dropped (ESM-only). Irrelevant post-swc-loader — the bundler consumes the ESM entry.
- v13:
enginesraised to node@20+; satisfied by this repo's floor. - v14: relies on the
cryptoglobal; available under the current browserslist targets.
Security: GHSA-w5hq-g745-h8pq is not reachable — the plugin only calls v4() and validate(). No peer-dependency additions, no new packages. Lockfile diff repoints one resolution, drops the orphaned uuid@11.1.1 entry, and refreshes transitive electron-to-chromium 1.5.395 → 1.5.396.
COMMENT rather than APPROVE only because a major production bump carries behavioral changes worth flagging; nothing here blocks merge.
Still open from the prior round (non-blocking, dependabot can't make this change): uuid is declared in three manifests at drifting versions — moving it into the pnpm catalog would keep them in lockstep. Follow-up, not a merge gate.
Prior-finding status
UNADDRESSED — kolibri/plugins/epub_viewer/package.json:21 — move uuid into the pnpm catalog to stop the three manifests drifting
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
Bumps [uuid](https://github.com/uuidjs/uuid) from 11.1.1 to 14.0.1. - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v11.1.1...v14.0.1) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
c6c98ed to
c629144
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15131 — 1 prior finding still open; no new findings.
uuid ^11.1.0 → ^14.0.1 in kolibri/plugins/epub_viewer — major bump (three majors), production dependency (bundled into the EPUB viewer plugin). CI passing on the current head (c629144).
Breaking changes across the range, and why none require code changes here:
- v12 — CommonJS build removed. Irrelevant to the bundle: swc-loader consumes the ESM entry, and
Frontend testspasses, exercising the import path under Jest. - v14 — Node 20+ required. Root
package.jsondeclares"engines": {"node": "^20.19.0"}. - v14 — requires a global
crypto. The browserslist floor is well pastcrypto.getRandomValues; uuid guards thecrypto.randomUUIDpath, which is absent on Kolibri's plain-HTTP LAN origins.
Security: v14.0.0 fixes GHSA-w5hq-g745-h8pq (out-of-bounds write in v3/v5/v6 with a caller-supplied buf/offset). Unreachable here — the plugin's only import is v4 in useCustomThemes.js:3, and repo-wide uuid is used as v4()/validate() only.
Peer dependencies: none added. The lockfile diff is one repointed resolution plus removal of the orphaned uuid@11.1.1 entry — no other transitive churn after the rebase.
This also converges the last manifest: packages/kolibri-common and packages/kolibri-sandbox already declare ^14.0.1 on develop, so merging ends a state where two uuid majors were bundled into pages that load side by side.
suggestion (still open, not a merge gate): kolibri/plugins/epub_viewer/package.json:21 — with all three manifests now on ^14.0.1, uuid is a candidate for the pnpm catalog so they stop drifting. Dependabot can't act on this; it belongs in a follow-up.
Prior-finding status
UNADDRESSED — kolibri/plugins/epub_viewer/package.json:21 — move uuid into the pnpm catalog to stop the three manifests drifting
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
1 participant
Bumps uuid from 11.1.1 to 14.0.1.
Release notes
Sourced from uuid's releases.
... (truncated)
Changelog
Sourced from uuid's changelog.
... (truncated)
Commits
7017780chore(main): release 14.0.1 (#964)f2c3e4bchore: fix release-please workflow (#963)27ffae5fix: add types condition to node export for moduleResolution bundler (#961)664cb31Remove outdated security contact information (#959)d729016fix(ci): checkout PR head commit in browser workflow (#957)89a5ebcWorkflows (#948)196e208chore: fix workflow (#947)95af448chore: update workflows (#946)3b57f95chore: add workflow_dispatch (#944)a433096chore: add 12.x and 13.x maintenance release branches (#941)Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Most Recent Ignore Conditions Applied to This Pull Request