Skip to content

refactor: Upgrade uuid from 10.0.0 to 11.1.0 #2568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 2 commits into from
Closed

refactor: Upgrade uuid from 10.0.0 to 11.1.0 #2568

wants to merge 2 commits into from

Conversation

@parseplatformorg
Copy link
Contributor

snyk-top-banner

Snyk has created this PR to upgrade uuid from 10.0.0 to 11.1.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 8 versions ahead of your current version.

  • The recommended version was released 2 months ago.

Release notes
Package name: uuid
  • 11.1.0 - 2025-02-19

    11.1.0 (2025-02-19)

    Features

    • update TS types to allowUint8Array subtypes for buffer option (#865) (a5231e7)
  • 11.0.5 - 2025-01-09

    11.0.5 (2025-01-09)

    Bug Fixes

  • 11.0.4 - 2025-01-05

    11.0.4 (2025-01-05)

    Bug Fixes

    • docs: insure -> ensure (#843) (d2a61e1)
    • exclude tests from published package (#840) (f992ff4)
    • Test for invalid byte array sizes and ranges in v1(), v4(), and v7() (#845) (e0ee900)
  • 11.0.3 - 2024-11-10

    11.0.3 (2024-11-04)

    Bug Fixes

  • 11.0.2 - 2024-10-28

    11.0.2 (2024-10-28)

    Bug Fixes

  • 11.0.1 - 2024-10-27

    11.0.1 (2024-10-27)

    Bug Fixes

  • 11.0.0 - 2024-10-27

    11.0.0 (2024-10-27)

    ⚠ BREAKING CHANGES

    • refactor v1 internal state and options logic (#780)
    • refactor v7 internal state and options logic, fixes #764 (#779)
    • Port to TypeScript, closes #762 (#763)
    • update node support matrix (only support node 16-20) (#750)
    • This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.
    • Remove the minified UMD build from the package.
    • Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.
    • Although in practice this is currently a noop since the resulting build does not change, the build will no longer transpiles future changes for Node.js 8.x targets, so semantically this is still a breaking change.
    • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.
    • The default export, which used to be the v4() method but which was already discouraged in v3.x of this library, has been removed.
    • Explicitly note that deep imports of the different uuid version functions are deprecated and no longer encouraged and that ECMAScript module named imports should be used instead. Emit a deprecation warning for people who deep-require the different algorithm variants.
    • Remove builtin support for insecure random number generators in the browser. Users who want that will have to supply their own random number generator function.
    • Remove support for generating v3 and v5 UUIDs in Node.js<4.x
    • Convert code base to ECMAScript Modules (ESM) and release CommonJS build for node and ESM build for browser bundlers.

    Features

    • add parse/stringify/validate/version/NIL APIs (#479) (0e6c10b)
    • add support for MAX uuid (new in RFC9562) (#714) (0385cd3)
    • add UMD build to npm package (#357) (4e75adf)
    • add various es module and CommonJS examples (b238510)
    • enforce Conventional Commit style commit messages (#282) (0705cd5)
    • ensure that docs are up-to-date in CI (ee5e77d)
    • hybrid CommonJS & ECMAScript modules build (a3f078f)
    • improve performance of v1 string representation (#453) (0ee0b67)
    • improve v4 performance by reusing random number array (#435) (bf4af0d)
    • optimize uuid.v1 by 1.3x uuid.v4 by 4.3x (430%) (#597) (3a033f6)
    • optimize V8 performance of bytesToUuid (#434) (e156415)
    • Port to TypeScript, closes #762 (#763) (1e0f987)
    • remove deep requires (#426) (daf72b8)
    • remove deprecated v4 string parameter (#454) (88ce3ca)
    • remove insecure fallback random number generator (3a5842b)
    • remove support for pre Node.js v4 Buffer API (#356) (b59b5c5)
    • remove UMD build (#645) (e948a0f), closes #620
    • rename repository to github:uuidjs/uuid (#351) (c37a518), closes #338
    • rename repository to github:uuidjs/uuid (#351) (e2d7314), closes #338
    • support v6 uuids (#754) (c4ed13e)
    • update node support matrix (only support node 16-20) (#750) (883b163)
    • use native crypto.randomUUID when available (#600) (c9e076c)
    • v8 support (#759) (35a5342)

    Bug Fixes

    Performance Improvements

    • nodejs: introduce pool into default rng (#513) (7f1af04)
    • remove superfluous call to toLowerCase (#677) (e53793f)

    Documentation

    • add note about removal of default export (#372) (12749b7), closes #370
    • deprecated deep requiring of the different algorithm versions (#361) (c0bdf15)

    Miscellaneous Chores

    Build System

    • drop Node.js 8.x from babel transpile target (#603) (aa11485)
    • drop support for legacy browsers (IE11, Safari 10) (#604) (0f433e5)
  • 11.0.0-0 - 2024-09-05

    chore(release): 11.0.0-0

  • 10.0.0 - 2024-06-09

    chore: typo in CHANGELOG

from uuid GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
feat: upgrade uuid from 10.0.0 to 11.1.0
3faed8f 
Snyk has created this PR to upgrade uuid from 10.0.0 to 11.1.0.

See this package in npm:
uuid

See this project in Snyk:
https://app.snyk.io/org/acinader/project/6e173dba-575d-4f4d-9506-7ebefca5868d?utm_source=github&utm_medium=referral&page=upgrade-pr
@parse-github-assistant
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title [Snyk] Upgrade uuid from 10.0.0 to 11.1.0 refactor: Upgrade uuid from 10.0.0 to 11.1.0 Apr 17, 2025
@parse-github-assistant
Copy link

parse-github-assistant bot commented Apr 17, 2025 •
edited
Loading

🚀 Thanks for opening this pull request!

@codecov
Copy link

codecov bot commented Apr 17, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (dcaccc2) to head (bf71efc).
Report is 22 commits behind head on alpha.

Additional details and impacted files 
@@            Coverage Diff            @@
##             alpha     #2568   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           64        64           
  Lines         6238      6238           
  Branches      1466      1450   -16     
=========================================
  Hits          6238      6238

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mtrezza
Copy link
Member

mtrezza commented May 3, 2025 •
edited
Loading

@coderabbitai what changes are necessary for this dependency upgrade? Can you make the change recommendations in review comments?

@coderabbitai
Copy link

coderabbitai bot commented May 3, 2025

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Get basic information about the PR
gh pr view 2568 --json title,body,files

# Get the list of commits for the PR to understand what changes were made
gh pr view 2568 --json commits

Length of output: 36502

🏁 Script executed:

#!/bin/bash
# Search for usages of uuid in the codebase
rg -l 'uuid' --type js --type ts

# Look for specific import patterns for uuid to understand migration needs
rg -A 3 'require\(.*uuid' --type js --type ts
rg -A 3 'import.*uuid' --type js --type ts

Length of output: 1907

🏁 Script executed:

#!/bin/bash
# Examine the uuid.ts file to understand current usage
cat src/uuid.ts

# Check for uuid type definitions
cat types/uuid.d.ts

# Let's check package.json to confirm the dependency and other relevant packages
cat package.json | grep -A 3 -B 3 uuid

Length of output: 915

@mtrezza Good news! After reviewing the codebase's usage of the UUID library, I found that minimal changes are needed for this upgrade from v10.0.0 to v11.1.0.

The codebase already follows best practices that align with UUID v11:

  1. You're using named imports in your wrapper (import { v4 } from 'uuid') which is the recommended pattern
  2. The main functionality you use (v4) remains unchanged in this version
  3. Your custom implementation for WeApp builds is independent of the library's internals

The major breaking changes in UUID v11 include:

  • Port to TypeScript (which may provide better type safety)
  • Removal of deep requires (not used in your codebase)
  • Removal of default export (you're already using named imports)
  • Internal refactoring of v1 and v7 UUIDs (you only use v4)

I recommend:

  1. Keep your existing wrapper as is - no changes needed
  2. Run your test suite to confirm everything works as expected
  3. Verify the integration test that imports directly from uuid (const { v4: uuidv4 } = require('uuid')) still passes

This upgrade should be very straightforward with no code changes required.

@coderabbitai
Copy link

coderabbitai bot commented May 3, 2025

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

I'll need to analyze this dependency upgrade to provide proper recommendations. Let me gather information about what's being changed in the PR first.

🏁 Script executed:

#!/bin/bash
# Get PR details and changed files
gh pr view 2568 --json title,body,files,commits

# Get the git diff to see exactly what changes are being made
git diff origin/alpha...HEAD

Length of output: 36548

Let me check the codebase to see how uuid is being used and what changes might be needed for this upgrade.

🏁 Script executed:

#!/bin/bash
# Check package.json for uuid dependency
cat package.json | grep uuid

# Find all usages of uuid in the codebase
rg "uuid" --type js --type ts

# Check specifically for import/require patterns
rg "require.*uuid|import.*uuid" --type js --type ts

Length of output: 3329

Let me examine the current uuid wrapper module to better understand the implementation.

🏁 Script executed:

#!/bin/bash
# Get the content of the uuid wrapper module
cat src/uuid.ts

Length of output: 616

Now I'll check if there are any type declarations for UUID in the project:

🏁 Script executed:

#!/bin/bash
# View the type declarations for uuid
cat types/uuid.d.ts

Length of output: 74

@mtrezza Based on my analysis of the codebase and the uuid v10.0.0 to v11.1.0 upgrade, the changes required are minimal since Parse SDK uses uuid through a wrapper module that isolates most of the codebase from direct dependency on uuid's specific API.

Here are my recommendations:

  1. No code changes are necessary because:

    • Your wrapper in src/uuid.ts already uses the named import import { v4 } from 'uuid' which is compatible with uuid v11
    • The functionality of v4 hasn't changed in a breaking way that would affect your usage

  2. Areas to test after the upgrade:

    • Verify that the WeApp platform code path still works correctly
    • Ensure integration tests that directly import uuid still pass
    • Check that UUID generation still functions as expected in all environments

  3. One thing to be aware of: uuid v11 dropped support for Node.js versions earlier than 16. If Parse SDK needs to support older Node.js versions, this could be an issue.

The PR looks good to merge as-is. The changes in uuid v11 are mostly related to its internal implementation, TypeScript conversion, and APIs you're not currently using.

@mtrezza mtrezza closed this May 3, 2025
@mtrezza mtrezza reopened this May 3, 2025
@mtrezza mtrezza closed this May 3, 2025
@mtrezza mtrezza deleted the snyk-upgrade-8e888bdc1d6be4097b8ccf0264fb2345 branch May 3, 2025 20:29
@parseplatformorg
Copy link
Contributor Author

⚠️ Snyk checks are incomplete.

⚠️ security/snyk check encountered an error. (View Details)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@parseplatformorg @mtrezza @snyk-bot