Skip to content

fix(middlewareNode): bump uuid 8.3.2 -> 11.1.1 (Issue 4) - #244

Open
Deepesh-Katudia wants to merge 1 commit into
chore/deps-middleware-googleapisfrom
chore/deps-middleware-uuid
Open

Deepesh-Katudia wants to merge 1 commit into
chore/deps-middleware-googleapisfrom
chore/deps-middleware-uuid

Conversation

@Deepesh-Katudia

@Deepesh-Katudia Deepesh-Katudia commented Sep 18, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Bump uuid 8.3.2 -> 11.1.1 in middlewareNode, isolated in its own PR so it can be reviewed and reverted on its own.

Part of a stacked series. Merge in order: audit-fix -> axios -> nodemailer -> googleapis -> uuid -> node-nlp. Each PR targets the previous branch, so its diff shows only its own bump; After merging each one, click "Delete branch" (this repo does not auto-delete merged branches). That makes GitHub retarget the next PR to main and run CI on it; if the branch is not deleted, the next PR must be retargeted to main by hand before merging, or it will merge into a dead branch. (5/6, stacked on #243)

Type of Change

  • New feature
  • Bug fix
  • Refactor
  • Documentation update
  • Style/UI update
  • Performance improvement
  • Other (please specify): dependency / security update (Issue 4)

Key Changes

  • middlewareNode/package.json: one-line range change; lockfile updated accordingly.
  • Deliberately not latest. uuid 14.x drops the CommonJS require export entirely, which would break require("uuid") at runtime in this CommonJS codebase, not just under Jest. 11.1.1 is the lowest release that is both non-vulnerable and CommonJS-compatible.

Testing

  • Unit tests added/updated
  • Integration tests added/updated
  • Manual testing performed: plain node -e "require(...)" of the package (catches CommonJS/ESM breakage that Jest mocks can hide)
  • All tests pass: 22/22 suites, 264/264 tests after clean npm ci

Bugs Fixed (if applicable)

  • npm audit after this PR: 3 findings (0 critical, 3 high)

TODO (Follow-up Work)

Additional Notes

Version vetted by @THRISHMA2424 on dependancyFix; regenerated fresh off current main.

Deliberately not latest: uuid 14.x drops the CommonJS require export entirely, which would break require("uuid") in this CommonJS codebase at runtime, not just under Jest. 11.1.1 is the lowest release that is both non-vulnerable and still CommonJS-compatible. Verified with a plain node require() as well as the test suite.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The change is a straightforward dependency+lockfile update scoped to middlewareNode and aligns with the existing CommonJS require("uuid") usage in this service.

Pull request overview

This PR updates the middlewareNode service’s uuid dependency to address audit/security concerns while keeping CommonJS require("uuid") compatibility for the existing route code.

Changes:

  • Bump uuid in middlewareNode/package.json from ^8.3.2 to ^11.1.1.
  • Regenerate middlewareNode/package-lock.json to lock uuid@11.1.1 and reflect updated package metadata.
File summaries
File Description
middlewareNode/package.json Updates the uuid semver range to ^11.1.1 for the middlewareNode service.
middlewareNode/package-lock.json Locks uuid to 11.1.1 and updates the corresponding resolved/integrity metadata.
Review details

Files not reviewed (1)

  • middlewareNode/package-lock.json: Generated file
  • Files reviewed: 1/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants