This is an automated email from the ASF dual-hosted git repository.
GitToTheHub pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cordova-node-xcode.git
The following commit(s) were added to refs/heads/master by this push:
new 1edf705 fix!: replace uuid dependency with crypto.randomUUID() (#153)
1edf705 is described below
commit 1edf7059d347beb0e339d1cb4741581352b43138
Author: Érik Escobedo <[email protected]>
AuthorDate: Tue Jun 2 08:32:05 2026 -0600
fix!: replace uuid dependency with crypto.randomUUID() (#153)
* fix!: replace uuid dependency with crypto.randomUUID()
uuid <14.0.0 is flagged by GHSA-w5hq-g745-h8pq (missing buffer bounds
check in v3/v5/v6 when buf is provided). The only upstream fix is uuid
v14, but v14 dropped CommonJS support, which would break this package.
Since only uuid.v4() is used here (in generateUuid()), replace it with
Node's built-in crypto.randomUUID() — available since Node 14.17.0,
produces the same RFC 4122 v4 UUID format, and requires no external
dependency. The uuid package is removed from dependencies entirely.
BREAKING CHANGE: Node >=14.17.0 is now required at runtime
(crypto.randomUUID
was introduced in that release). The engines field remains >=10.0.0; a
separate PR will bump it to reflect the new minimum.
All 426 existing tests pass.
* chore(npm): update package-lock.json
---------
Co-authored-by: Manuel Beck <[email protected]>
---
lib/pbxProject.js | 4 ++--
package-lock.json | 13 ++-----------
package.json | 3 +--
3 files changed, 5 insertions(+), 15 deletions(-)
diff --git a/lib/pbxProject.js b/lib/pbxProject.js
index c711fa2..a0e6fb4 100644
--- a/lib/pbxProject.js
+++ b/lib/pbxProject.js
@@ -21,7 +21,7 @@ const util = require('util');
const f = util.format;
const EventEmitter = require('events').EventEmitter;
const path = require('path');
-const uuid = require('uuid');
+const crypto = require('crypto');
const fork = require('child_process').fork;
const PBXWriter = require('./pbxWriter');
const PBXFile = require('./pbxFile');
@@ -88,7 +88,7 @@ PBXProject.prototype.allUuids = function () {
};
PBXProject.prototype.generateUuid = function () {
- const id = uuid.v4()
+ const id = crypto.randomUUID()
.replace(/-/g, '')
.substr(0, 24)
.toUpperCase();
diff --git a/package-lock.json b/package-lock.json
index 8b52bbc..bc57e16 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,15 +9,14 @@
"version": "4.0.0-dev.0",
"license": "Apache-2.0",
"dependencies": {
- "simple-plist": "^1.1.0",
- "uuid": "^7.0.3"
+ "simple-plist": "^1.1.0"
},
"devDependencies": {
"@cordova/eslint-config": "^6.0.1",
"pegjs": "^0.10.0"
},
"engines": {
- "node": ">=10.0.0"
+ "node": ">=14.17.0"
}
},
"node_modules/@cordova/eslint-config": {
@@ -3237,14 +3236,6 @@
"punycode": "^2.1.0"
}
},
- "node_modules/uuid": {
- "version": "7.0.3",
- "resolved": "https://registry.npmjs.org/uuid/-/uuid-7.0.3.tgz";,
- "integrity":
"sha512-DPSke0pXhTZgoF/d+WSt2QaKMCFSfx7QegxEWT+JOuHF5aWrKEn0G+ztjuJg/gG8/ItK+rbPCD/yNv8yyih6Cg==",
- "bin": {
- "uuid": "dist/bin/uuid"
- }
- },
"node_modules/which": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz";,
diff --git a/package.json b/package.json
index 0473bb4..4881f3d 100644
--- a/package.json
+++ b/package.json
@@ -10,8 +10,7 @@
"node": ">=14.17.0"
},
"dependencies": {
- "simple-plist": "^1.1.0",
- "uuid": "^7.0.3"
+ "simple-plist": "^1.1.0"
},
"devDependencies": {
"@cordova/eslint-config": "^6.0.1",
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
