Skip to content

Conversation

@daveisfera
Copy link

Fixes #925

@daveisfera daveisfera requested review from a team as code owners October 25, 2023 18:02
@peterdeme
Copy link

Bump to this 👀

@Kurt-von-Laven
Copy link
Contributor

Yarn v4 was released on October 22nd, and yarn npm audit --all --recursive doesn't pass on packages such as @actions/cache that depend on deprecated packages like uuid v6 and earlier.

└─ uuid
   ├─ ID: uuid (deprecation)
   ├─ Issue: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
   ├─ Severity: moderate
   ├─ Vulnerable Versions: 3.4.0
   │ 
   ├─ Tree Versions
   │  └─ 3.4.0
   │ 
   └─ Dependents
      └─ @actions/cache@npm:3.2.2

@shyim
Copy link

shyim commented Jan 14, 2024

can we not just use randomUUID from webcrypto? GH Actions anyway use node 20:
https://developer.mozilla.org/en-US/docs/Web/API/Crypto/randomUUID

Copy link
Contributor

@joshmgross joshmgross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👋 Thank you for your contribution!

As suggested by #1571 (comment) and #925 (comment), I think it would be best to remove this dependency entirely in favor of the built-in crypto.randomUUID.

I put up a PR with that change #1824

@joshmgross
Copy link
Contributor

Replaced by #1824

@joshmgross joshmgross closed this Oct 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Avoid using deprecated version of UUID

5 participants