trails-cool/trails
Watch
1
1
Fork
You've already forked trails
 0
Code Issues 2 Pull requests Projects Releases Packages Activity Actions 10

chore(deps): Update dependency uuid@7.0.3 to v14 #47

Closed
renovate wants to merge 1 commit from renovate/uuid7.0.3-14.x into main
pull from: renovate/uuid7.0.3-14.x
merge into: trails-cool:main
Conversation 2 Commits 1 Files changed 2 +6 -6
renovate commented 2026-07-28 07:31:38 +00:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
uuid@7.0.3 11.1.1 → 14.0.1 age confidence

Release Notes

uuidjs/uuid (uuid@7.0.3)

v14.0.1

Compare Source

Bug Fixes
  • add types condition to node export for moduleResolution bundler (#​961) (27ffae5)

v14.0.0

Compare Source

Security
  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.
⚠ BREAKING CHANGES
  • crypto is now expected to be globally defined (requires node@​20+) (#​935)
  • drop node@​18 support (#​934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

v13.0.2

Compare Source

Bug Fixes
  • rerelease to fix provenance. (49ccb35)

v13.0.1

Compare Source

Bug Fixes
  • backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

Compare Source

⚠ BREAKING CHANGES
  • make browser exports the default (#​901)
Bug Fixes

v12.0.1

Compare Source

Bug Fixes
  • backport fix for GHSA-w5hq-g745-h8pq (3d61d6a)

v12.0.0

Compare Source

⚠ BREAKING CHANGES
  • update to typescript@​5.2 (#​887)
  • remove CommonJS support (#​886)
  • drop node@​16 support (#​883)
Features
Bug Fixes

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [uuid@7.0.3](https://github.com/uuidjs/uuid) | [`11.1.1` → `14.0.1`](https://renovatebot.com/diffs/npm/uuid@7.0.3/11.1.1/14.0.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/uuid/14.0.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/uuid/11.1.1/14.0.1?slim=true) | --- ### Release Notes <details> <summary>uuidjs/uuid (uuid@7.0.3)</summary> ### [`v14.0.1`](https://github.com/uuidjs/uuid/blob/HEAD/CHANGELOG.md#1401-2026-06-20) [Compare Source](https://github.com/uuidjs/uuid/compare/v14.0.0...v14.0.1) ##### Bug Fixes - add types condition to node export for moduleResolution bundler ([#&#8203;961](https://github.com/uuidjs/uuid/issues/961)) ([27ffae5](https://github.com/uuidjs/uuid/commit/27ffae5e867823b8c7db255975d65358fbdb1a7e)) ### [`v14.0.0`](https://github.com/uuidjs/uuid/blob/HEAD/CHANGELOG.md#1400-2026-04-19) [Compare Source](https://github.com/uuidjs/uuid/compare/v13.0.2...v14.0.0) ##### Security - Fixes [GHSA-w5hq-g745-h8pq](https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq): `v3()`, `v5()`, and `v6()` did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid `offset` was provided. A `RangeError` is now thrown if `offset < 0` or `offset + 16 > buf.length`. ##### ⚠ BREAKING CHANGES - `crypto` is now expected to be globally defined (requires node\@&#8203;20+) ([#&#8203;935](https://github.com/uuidjs/uuid/issues/935)) - drop node\@&#8203;18 support ([#&#8203;934](https://github.com/uuidjs/uuid/issues/934)) - upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years ### [`v13.0.2`](https://github.com/uuidjs/uuid/releases/tag/v13.0.2) [Compare Source](https://github.com/uuidjs/uuid/compare/v13.0.1...v13.0.2) ##### Bug Fixes - rerelease to fix provenance. ([49ccb35](https://github.com/uuidjs/uuid/commit/49ccb35f78c0c4ce1409dd2f1d89f83caadba10b)) ### [`v13.0.1`](https://github.com/uuidjs/uuid/releases/tag/v13.0.1) [Compare Source](https://github.com/uuidjs/uuid/compare/v13.0.0...v13.0.1) ##### Bug Fixes - backport fix for GHSA-w5hq-g745-h8pq ([9d27ddf](https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a)) ### [`v13.0.0`](https://github.com/uuidjs/uuid/blob/HEAD/CHANGELOG.md#1300-2025-09-08) [Compare Source](https://github.com/uuidjs/uuid/compare/v12.0.1...v13.0.0) ##### ⚠ BREAKING CHANGES - make browser exports the default ([#&#8203;901](https://github.com/uuidjs/uuid/issues/901)) ##### Bug Fixes - make browser exports the default ([#&#8203;901](https://github.com/uuidjs/uuid/issues/901)) ([bce9d72](https://github.com/uuidjs/uuid/commit/bce9d72a3ae5b9a3dcd8eb21ef6d1820288a427a)) ### [`v12.0.1`](https://github.com/uuidjs/uuid/releases/tag/v12.0.1) [Compare Source](https://github.com/uuidjs/uuid/compare/v12.0.0...v12.0.1) ##### Bug Fixes - backport fix for GHSA-w5hq-g745-h8pq ([3d61d6a](https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d)) ### [`v12.0.0`](https://github.com/uuidjs/uuid/blob/HEAD/CHANGELOG.md#1200-2025-09-05) [Compare Source](https://github.com/uuidjs/uuid/compare/v11.1.1...v12.0.0) ##### ⚠ BREAKING CHANGES - update to typescript\@&#8203;5.2 ([#&#8203;887](https://github.com/uuidjs/uuid/issues/887)) - remove CommonJS support ([#&#8203;886](https://github.com/uuidjs/uuid/issues/886)) - drop node\@&#8203;16 support ([#&#8203;883](https://github.com/uuidjs/uuid/issues/883)) ##### Features - add node\@&#8203;24 to ci matrix ([#&#8203;879](https://github.com/uuidjs/uuid/issues/879)) ([42b6178](https://github.com/uuidjs/uuid/commit/42b6178aa21a593257f0a72abacd220f0b7b8a92)) - drop node\@&#8203;16 support ([#&#8203;883](https://github.com/uuidjs/uuid/issues/883)) ([0f38cf1](https://github.com/uuidjs/uuid/commit/0f38cf10366ab074f9328ae2021eea04d5f2e530)) - remove CommonJS support ([#&#8203;886](https://github.com/uuidjs/uuid/issues/886)) ([ae786e2](https://github.com/uuidjs/uuid/commit/ae786e27265f50bcf7cead196c29f1869297c42f)) - update to typescript\@&#8203;5.2 ([#&#8203;887](https://github.com/uuidjs/uuid/issues/887)) ([c7ee405](https://github.com/uuidjs/uuid/commit/c7ee40598ed78584d81ab78dffded9fe5ff20b01)) ##### Bug Fixes - improve v4() performance ([#&#8203;894](https://github.com/uuidjs/uuid/issues/894)) ([5fd974c](https://github.com/uuidjs/uuid/commit/5fd974c12718c8848035650b69b8948f12ace197)) - restore node: prefix ([#&#8203;889](https://github.com/uuidjs/uuid/issues/889)) ([e1f42a3](https://github.com/uuidjs/uuid/commit/e1f42a354593093ba0479f0b4047dae82d28c507)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Copenhagen) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODEuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJtYWpvciIsInNlY3VyaXR5LXBpbiJdfQ==-->
chore(deps): Update dependency uuid@7.0.3 to v14
Some checks failed
CD Staging / Build & Push Docker Images (pull_request) Has been skipped
Details
CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped
Details
CD Staging / Deploy Staging (pull_request) Has been skipped
Details
CD Staging / Deploy PR Preview (pull_request) Has been skipped
Details
CI / Security Scan (pull_request) Successful in 46s
Details
CI / Dockerfile Package Check (pull_request) Successful in 17s
Details
CI / Checks (pull_request) Failing after 7m38s
Details
CI / E2E Tests (pull_request) Has been skipped
Details
CI / Visual Tests (pull_request) Successful in 5m55s
Details
CI / Journal Image Smoke Test (pull_request) Successful in 19m44s
Details
CD Staging / Tear Down PR Preview (pull_request) Successful in 33s
Details
0c283a2baa
ullrich commented 2026-07-30 11:32:50 +00:00
Owner
Copy link

Closing: superseded by #56, which freezes the version line of `pnpm.overrides` security pins (minor and major disabled, patch still flows).

This entry is a CVE floor, not a dependency — the correct value is the minimum patched version inside the range its consumers expect, not the newest release. No current advisory requires leaving the pinned line, so this change is risk without benefit. Renovate will no longer raise it.

If a future advisory can only be satisfied by crossing a minor or major, that becomes a deliberate manual change (ideally driven by osvVulnerabilityAlerts once configured).

Closing: superseded by #56, which freezes the version line of \`pnpm.overrides\` security pins (minor and major disabled, patch still flows). This entry is a CVE floor, not a dependency — the correct value is the minimum patched version inside the range its consumers expect, not the newest release. No current advisory requires leaving the pinned line, so this change is risk without benefit. Renovate will no longer raise it. If a future advisory can only be satisfied by crossing a minor or major, that becomes a deliberate manual change (ideally driven by `osvVulnerabilityAlerts` once configured).
ullrich closed this pull request 2026-07-30 11:32:50 +00:00
renovate commented 2026-07-31 07:44:48 +00:00
Author
Collaborator
Copy link

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 14.x releases. But if you manually upgrade to 14.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

### Renovate Ignore Notification Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for *any* future `14.x` releases. But if you manually upgrade to `14.x` then Renovate will re-enable `minor` and `patch` updates automatically. If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
Some checks failed
CD Staging / Build & Push Docker Images (pull_request) Has been skipped
Details
CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped
Details
CD Staging / Deploy Staging (pull_request) Has been skipped
Details
CD Staging / Deploy PR Preview (pull_request) Has been skipped
Details
CI / Security Scan (pull_request) Successful in 46s
Required
Details
CI / Dockerfile Package Check (pull_request) Successful in 17s
Required
Details
CI / Checks (pull_request) Failing after 7m38s
Required
Details
CI / E2E Tests (pull_request) Has been skipped
Required
Details
CI / Visual Tests (pull_request) Successful in 5m55s
Required
Details
CI / Journal Image Smoke Test (pull_request) Successful in 19m44s
Required
Details
CD Staging / Tear Down PR Preview (pull_request) Successful in 33s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
dependencies
Dependency updates raised by Renovate (renovate.json5 labels)

  
major
Major version bump — always needs human review, never auto-merged

  
security-pin
Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels
dependencies
major
security-pin
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
trails-cool/trails!47
No description provided.