chore(deps): bump uuid from 8.3.2 to 14.0.0 by dependabot[bot] · Pull Request #2328 · hyperdxio/hyperdx

dependabot · 2026-05-22T09:03:40Z

Bumps uuid from 8.3.2 to 14.0.0.

Release notes

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

expect crypto to be global everywhere (requires node@20+) (#935)

drop node@18 support (#934)

Features

drop node@18 support (#934) (dc4ddb8)

Bug Fixes

expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)

Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

crypto is now expected to be globally defined (requires node@20+) (#935)

drop node@18 support (#934)

upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

update to typescript@5.2 (#887)

remove CommonJS support (#886)

drop node@16 support (#883)

Features

add node@24 to ci matrix (#879) (42b6178)

drop node@16 support (#883) (0f38cf1)

remove CommonJS support (#886) (ae786e2)

update to typescript@5.2 (#887) (c7ee405)

Bug Fixes

improve v4() performance (#894) (5fd974c)

restore node: prefix (#889) (e1f42a3)

11.1.0 (2025-02-19)

... (truncated)

Commits

7c1ea08 chore(main): release 14.0.0 (#926)
3d2c5b0 Merge commit from fork
f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
529ef08 chore: upgrade TypeScript and fixup types (#927)
086fd79 chore: update dependencies (#933)
dc4ddb8 feat!: drop node@18 support (#934)
0f1f9c9 chore: switch to Biome for parsing and linting (#932)
e2879e6 chore: use maintained version of npm-run-all (#930)
ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
0423d49 docs: remove obsolete v1 option notes (#915)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [uuid](https://github.com/uuidjs/uuid) from 8.3.2 to 14.0.0. - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v8.3.2...v14.0.0) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-05-22T09:03:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Error		May 22, 2026 9:04am

changeset-bot · 2026-05-22T09:03:49Z

⚠️ No Changeset found

Latest commit: 899f9ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-05-22T09:04:09Z

🟢 Tier 1 — Trivial

Docs, images, lock files, or a dependency bump. No functional code changes detected.

Why this tier:

Bot author: dependabot[bot]

Review process: Auto-merge once CI passes. No human review required.
SLA: Resolves automatically.

Stats

Production files changed: 1
Production lines changed: 2
Branch: dependabot/npm_and_yarn/uuid-14.0.0
Author: dependabot[bot]

To override this classification, remove the review/tier-1 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

github-actions · 2026-05-22T09:05:07Z

Knip - Unused Code Analysis

🔴 1 issue found

Unused devDependencies (1)

packages/api/package.json:@types/uuid

Knip finds unused files, dependencies, and exports in your codebase.
Run yarn knip locally to see full details.

github-actions · 2026-05-22T09:11:05Z

Deep Review

This is a uuid major-version bump (^8.3.2 -> ^14.0.0) that spans 6 major releases. Only v4() is used (no arguments) at 4 production sites plus 1 migration. The diff itself contains no source code changes, but uuid is now ESM-only and the api workspace builds CommonJS, which raises two real concerns.

🔴 P0/P1 -- must fix

packages/api/jest.config.js:1 -- The jest config uses ts-jest's createJsWithTsPreset() in default CommonJS mode with no transformIgnorePatterns override, no extensionsToTreatAsEsm, and no module-name mapper; transitively importing uuid from any of the 4 model/controller files (loaded by controllers/__tests__/team.test.ts, models/__tests__/index.test.ts, the routers/{api,external-api}/__tests__/*.test.ts suites, and others) compiles to require('uuid'), which jest's CJS runtime resolves through its own module loader rather than Node's require(esm) bridge, so an ESM-only uuid@14 is expected to surface ERR_REQUIRE_ESM or SyntaxError: Cannot use import statement outside a module at test load time.
- Fix: Run yarn workspace @hyperdx/api test against this branch; if it fails on uuid resolution, add transformIgnorePatterns: ['/node_modules/(?!uuid)/'] plus the ts-jest ESM hooks to packages/api/jest.config.js, or replace uuidv4() calls with the built-in crypto.randomUUID() since Node >=22.16 is already required.
- _{correctness, testing}

🟡 P2 -- recommended

packages/api/package.json:69 -- @types/uuid: "^8.3.4" is retained, but uuid has shipped its own bundled TypeScript declarations since v11; the DefinitelyTyped package is deprecated and pinned to a 6-major-version-stale type surface, which is dead weight today and a footgun for any future code that touches v14-only call shapes (e.g. the new RangeError contract on v3/v5/v6 offsets).
- Fix: Remove "@types/uuid": "^8.3.4" from packages/api/package.json devDependencies in this same PR and rerun yarn install so uuid's bundled types are the sole source.
- _{correctness, testing, maintainability, kieran-typescript, reliability}

🔵 P3 nitpicks (1)

packages/api/migrations/mongo/20231130053610-add_accessKey_field_to_user_collection.ts:2 -- The migration statically imports uuid and is loaded by migrate-mongo@11 under moduleSystem: 'commonjs', so each migration run will route through Node 22's require(esm) path and historically emits ExperimentalWarning; this is a dev/ops cold path with no production blast radius.
- Fix: Optionally silence with --no-warnings=ExperimentalWarning when invoking migrate-mongo, or convert this single import to const { v4: uuidv4 } = await import('uuid') inside the migration's up.

Reviewers (6): correctness, testing, maintainability, project-standards, reliability, kieran-typescript.

Testing gaps:

No CI evidence in the diff that yarn workspace @hyperdx/api test and yarn workspace @hyperdx/api build (tsc with module: Node16) both pass against uuid@14 -- merge gated on a green run of those steps, not just the build.
No smoke test exercises a migrate-mongo up cycle to confirm the cold-path require(esm) of uuid resolves cleanly.

github-actions · 2026-05-22T09:11:57Z

E2E Test Results

✅ All tests passed • 179 passed • 3 skipped • 1213s

Status	Count
✅ Passed	179
❌ Failed	0
⚠️ Flaky	3
⏭️ Skipped	3

Tests ran across 4 shards in parallel.

View full report →

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 22, 2026

github-actions Bot added the review/tier-1 Trivial — auto-merge candidate once CI passes label May 22, 2026

vercel Bot had a problem deploying to Preview May 22, 2026 09:04 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump uuid from 8.3.2 to 14.0.0#2328

chore(deps): bump uuid from 8.3.2 to 14.0.0#2328
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/uuid-14.0.0

dependabot Bot commented on behalf of github May 22, 2026

Uh oh!

vercel Bot commented May 22, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

github-actions Bot commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 22, 2026

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

Features

Bug Fixes

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

Bug Fixes

v12.0.1

12.0.1 (2026-04-29)

14.0.0 (2026-04-19)

Security

⚠ BREAKING CHANGES

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

Features

Bug Fixes

11.1.0 (2025-02-19)

Uh oh!

vercel Bot commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented May 22, 2026

⚠️ No Changeset found

Uh oh!

github-actions Bot commented May 22, 2026

🟢 Tier 1 — Trivial

Uh oh!

github-actions Bot commented May 22, 2026

Knip - Unused Code Analysis

Unused devDependencies (1)

Uh oh!

github-actions Bot commented May 22, 2026

Deep Review

🔴 P0/P1 -- must fix

🟡 P2 -- recommended

Uh oh!

github-actions Bot commented May 22, 2026

E2E Test Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented May 22, 2026 •

edited

Loading