Skip to content

Update dependency uuid to v14 [SECURITY] - abandoned #8794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
backstage-goalie wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update dependency uuid to v14 [SECURITY] - abandoned #8794

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
999b642
Update dependency uuid to v14 [SECURITY]
backstage-goalie[bot] Apr 26, 2026
4f4aa4b
chore(mcp-chat): Remove deprecated types/uuid dependency
gaelgoth Apr 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions workspaces/agent-forge/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-agent-forge': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/agent-forge/plugins/agent-forge/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@
"@mui/material": "^5.16.6",
"@mui/styles": "^5.16.6",
"react-use": "^17.2.4",
"uuid": "^11.1.0"
"uuid": "^14.0.0"

Copilot AI Apr 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uuid v14 raises its minimum supported TypeScript version to >=5.4.3 (per upstream release notes). This workspace currently pins TypeScript to ~5.3.0 (workspaces/agent-forge/package.json), and CI runs yarn tsc:full with --skipLibCheck false, so this upgrade is likely to fail type-checking. Please bump the workspace TypeScript devDependency to >=5.4.3 (or a newer repo-standard version) and regenerate the lockfile if needed.

Copilot uses AI. Check for mistakes.

Copilot AI Apr 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uuid@^14 lists TypeScript >= 5.4.3 as the minimum supported version, but this workspace is pinned to typescript@~5.3.0 (resolves to 5.3.3 in this workspace yarn.lock). This can cause type-check/build failures; please bump the workspace TypeScript version (or otherwise ensure tsc runs on >=5.4.3) alongside this uuid upgrade.

Copilot uses AI. Check for mistakes.
},
Comment on lines 44 to 46

Copilot AI Apr 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uuid@14.0.0 raises the uuid project’s minimum supported TypeScript version to 5.4.3 (per its v14 release notes). This workspace currently pins TypeScript to ~5.3.0 (workspaces/agent-forge/package.json), which can lead to type-check/build failures; please bump the workspace TypeScript version to >=5.4.3 (or align with the repo’s newer TypeScript versions) before landing this update.

Copilot uses AI. Check for mistakes.
"peerDependencies": {
"react": "^16.13.1 || ^17.0.0 || ^18.0.0",
Expand Down
13 changes: 11 additions & 2 deletions workspaces/agent-forge/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -722,7 +722,7 @@ __metadata:
react-dom: "npm:^18"
react-router-dom: "npm:^6"
react-use: "npm:^17.2.4"
uuid: "npm:^11.1.0"
uuid: "npm:^14.0.0"
uuidv4: "npm:6.2.13"
peerDependencies:
react: ^16.13.1 || ^17.0.0 || ^18.0.0
Expand Down Expand Up @@ -20245,7 +20245,7 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^11.0.0, uuid@npm:^11.1.0":
"uuid@npm:^11.0.0":
version: 11.1.0
resolution: "uuid@npm:11.1.0"
bin:
Expand All @@ -20254,6 +20254,15 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

"uuid@npm:^3.4.0":
version: 3.4.0
resolution: "uuid@npm:3.4.0"
Expand Down
5 changes: 5 additions & 0 deletions workspaces/announcements/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-announcements-backend': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/announcements/plugins/announcements-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
"knex": "^3.0.1",
"luxon": "^3.2.0",
"slugify": "^1.6.6",
"uuid": "^13.0.0"
"uuid": "^14.0.0"

Copilot AI Apr 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uuid v14 requires TypeScript >=5.4.3 upstream. This workspace pins TypeScript to ~5.4.0 (workspaces/announcements/package.json) and CI runs yarn tsc:full with --skipLibCheck false, so the repo may fail to compile after this upgrade. Please bump the workspace TypeScript devDependency to >=5.4.3 (or align to the repo’s current standard) and re-run installs as needed.

Copilot uses AI. Check for mistakes.
},
"devDependencies": {
"@backstage/cli": "backstage:^",
Expand Down
10 changes: 5 additions & 5 deletions workspaces/announcements/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1795,7 +1795,7 @@ __metadata:
luxon: "npm:^3.2.0"
slugify: "npm:^1.6.6"
supertest: "npm:^7.0.0"
uuid: "npm:^13.0.0"
uuid: "npm:^14.0.0"
languageName: unknown
linkType: soft

Expand Down Expand Up @@ -30104,12 +30104,12 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^13.0.0":
version: 13.0.0
resolution: "uuid@npm:13.0.0"
"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

Expand Down
5 changes: 5 additions & 0 deletions workspaces/azure-resources/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-catalog-backend-module-azure-resources': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/azure-resources/plugins/catalog-backend-module-azure-resources/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
"@backstage/catalog-model": "backstage:^",
"@backstage/plugin-catalog-node": "backstage:^",
"lodash": "^4.17.21",
"uuid": "^13.0.0"
"uuid": "^14.0.0"
},
"devDependencies": {
"@backstage/backend-defaults": "backstage:^",
Expand Down
10 changes: 5 additions & 5 deletions workspaces/azure-resources/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1685,7 +1685,7 @@ __metadata:
"@backstage/plugin-catalog-node": "backstage:^"
"@types/lodash": "npm:^4.17.20"
lodash: "npm:^4.17.21"
uuid: "npm:^13.0.0"
uuid: "npm:^14.0.0"
languageName: unknown
linkType: soft

Expand Down Expand Up @@ -22329,12 +22329,12 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^13.0.0":
version: 13.0.0
resolution: "uuid@npm:13.0.0"
"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

Expand Down
5 changes: 5 additions & 0 deletions workspaces/badges/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-badges-backend': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/badges/plugins/badges-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@
"express-promise-router": "^4.1.0",
"knex": "^3.0.0",
"lodash": "^4.17.21",
"uuid": "^13.0.0"
"uuid": "^14.0.0"
},
"devDependencies": {
"@backstage/backend-test-utils": "backstage:^",
Expand Down
10 changes: 5 additions & 5 deletions workspaces/badges/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2073,7 +2073,7 @@ __metadata:
knex: "npm:^3.0.0"
lodash: "npm:^4.17.21"
supertest: "npm:^7.0.0"
uuid: "npm:^13.0.0"
uuid: "npm:^14.0.0"
languageName: unknown
linkType: soft

Expand Down Expand Up @@ -26500,12 +26500,12 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^13.0.0":
version: 13.0.0
resolution: "uuid@npm:13.0.0"
"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

Expand Down
5 changes: 5 additions & 0 deletions workspaces/code-coverage/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-code-coverage-backend': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/code-coverage/plugins/code-coverage-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
"express": "^4.17.1",
"express-promise-router": "^4.1.0",
"knex": "^3.0.0",
"uuid": "^13.0.0",
"uuid": "^14.0.0",
"yn": "^4.0.0"
},
"devDependencies": {
Expand Down
10 changes: 5 additions & 5 deletions workspaces/code-coverage/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1253,7 +1253,7 @@ __metadata:
express-promise-router: "npm:^4.1.0"
knex: "npm:^3.0.0"
supertest: "npm:^7.0.0"
uuid: "npm:^13.0.0"
uuid: "npm:^14.0.0"
xml2js: "npm:^0.6.0"
yn: "npm:^4.0.0"
languageName: unknown
Expand Down Expand Up @@ -25266,12 +25266,12 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^13.0.0":
version: 13.0.0
resolution: "uuid@npm:13.0.0"
"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

Expand Down
5 changes: 5 additions & 0 deletions workspaces/keycloak/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-catalog-backend-module-keycloak': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/keycloak/plugins/catalog-backend-module-keycloak/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
"jsonwebtoken": "^9.0.0",
"lodash": "^4.17.21",
"p-limit": "^6.1.0",
"uuid": "^13.0.0"
"uuid": "^14.0.0"
},
"devDependencies": {
"@backstage/backend-defaults": "^0.16.0",
Expand Down
10 changes: 5 additions & 5 deletions workspaces/keycloak/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1188,7 +1188,7 @@ __metadata:
lodash: "npm:^4.17.21"
open-cli: "npm:^8.0.0"
p-limit: "npm:^6.1.0"
uuid: "npm:^13.0.0"
uuid: "npm:^14.0.0"
languageName: unknown
linkType: soft

Expand Down Expand Up @@ -20250,12 +20250,12 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^13.0.0":
version: 13.0.0
resolution: "uuid@npm:13.0.0"
"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

Expand Down
5 changes: 5 additions & 0 deletions workspaces/linguist/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-linguist-backend': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/linguist/plugins/linguist-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@
"linguist-js": "^2.5.3",
"luxon": "^3.0.0",
"node-fetch": "^2.6.7",
"uuid": "^13.0.0",
"uuid": "^14.0.0",
"yn": "^4.0.0"
},
"devDependencies": {
Expand Down
10 changes: 5 additions & 5 deletions workspaces/linguist/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1276,7 +1276,7 @@ __metadata:
luxon: "npm:^3.0.0"
node-fetch: "npm:^2.6.7"
supertest: "npm:^7.0.0"
uuid: "npm:^13.0.0"
uuid: "npm:^14.0.0"
yn: "npm:^4.0.0"
languageName: unknown
linkType: soft
Expand Down Expand Up @@ -26285,12 +26285,12 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^13.0.0":
version: 13.0.0
resolution: "uuid@npm:13.0.0"
"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

Expand Down
5 changes: 5 additions & 0 deletions workspaces/mcp-chat/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-mcp-chat-backend': patch
---

Updated dependency `uuid` to `^14.0.0` and removed deprecated `@types/uuid`.
3 changes: 1 addition & 2 deletions workspaces/mcp-chat/plugins/mcp-chat-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,14 +39,13 @@
"express-promise-router": "^4.1.0",
"knex": "^3.1.0",
"ollama": "^0.6.0",
"uuid": "^11.0.0"
"uuid": "^14.0.0"

Copilot AI Apr 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uuid v14 requires TypeScript >=5.4.3 upstream. This workspace pins TypeScript to ~5.4.0 (workspaces/mcp-chat/package.json) and CI runs yarn tsc:full with --skipLibCheck false, so this dependency bump may break type-checking. Please bump the workspace TypeScript devDependency to >=5.4.3 (or align to the repo’s current standard) and update the lockfile accordingly.

Copilot uses AI. Check for mistakes.

Copilot AI Apr 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Upgrading to uuid@^14 raises the runtime requirement to Node.js 20+ (uuid now expects a global crypto). The plugin docs currently state Node.js 18+; please either update the stated support/docs (and/or add an engines.node constraint) or avoid this upgrade if Node 18 support is still required.

Copilot uses AI. Check for mistakes.
},
"devDependencies": {
"@backstage/backend-test-utils": "^1.11.2",
"@backstage/cli": "^0.36.1",
"@types/express": "^4.17.6",
"@types/supertest": "^7.0.0",
"@types/uuid": "^11.0.0",
"supertest": "^7.0.0"
},
"files": [
Expand Down
30 changes: 10 additions & 20 deletions workspaces/mcp-chat/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1294,13 +1294,12 @@ __metadata:
"@modelcontextprotocol/sdk": "npm:^1.25.2"
"@types/express": "npm:^4.17.6"
"@types/supertest": "npm:^7.0.0"
"@types/uuid": "npm:^11.0.0"
express: "npm:^4.22.0"
express-promise-router: "npm:^4.1.0"
knex: "npm:^3.1.0"
ollama: "npm:^0.6.0"
supertest: "npm:^7.0.0"
uuid: "npm:^11.0.0"
uuid: "npm:^14.0.0"
languageName: unknown
linkType: soft

Expand Down Expand Up @@ -8489,15 +8488,6 @@ __metadata:
languageName: node
linkType: hard

"@types/uuid@npm:^11.0.0":
version: 11.0.0
resolution: "@types/uuid@npm:11.0.0"
dependencies:
uuid: "npm:*"
checksum: 10/9f94bd34e5d220c53cc58ea9f48a0061d3bc343e29bc33a17edc705f5e21fedda21553318151f2bc227c2b2b03727bbb536da2b82a61f84d2e1ca38abc5e5c3f
languageName: node
linkType: hard

"@types/webpack-env@npm:^1.15.2":
version: 1.18.8
resolution: "@types/webpack-env@npm:1.18.8"
Expand Down Expand Up @@ -24842,15 +24832,6 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:*":
version: 13.0.0
resolution: "uuid@npm:13.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef
languageName: node
linkType: hard

"uuid@npm:^10.0.0":
version: 10.0.0
resolution: "uuid@npm:10.0.0"
Expand All @@ -24869,6 +24850,15 @@ __metadata:
languageName: node
linkType: hard

"uuid@npm:^14.0.0":
version: 14.0.0
resolution: "uuid@npm:14.0.0"
bin:
uuid: dist-node/bin/uuid
checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b
languageName: node
linkType: hard

"uuid@npm:^3.4.0":
version: 3.4.0
resolution: "uuid@npm:3.4.0"
Expand Down
5 changes: 5 additions & 0 deletions workspaces/pingidentity/.changeset/renovate-e746f7d.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-catalog-backend-module-pingidentity': patch
---

Updated dependency `uuid` to `^14.0.0`.
2 changes: 1 addition & 1 deletion workspaces/pingidentity/plugins/catalog-backend-module-pingidentity/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
"@backstage/config": "^1.3.6",
"@backstage/plugin-catalog-node": "^2.1.0",
"node-fetch": "^2.6.7",
"uuid": "^13.0.0"
"uuid": "^14.0.0"
},
"devDependencies": {
"@backstage/backend-defaults": "^0.16.0",
Expand Down
Loading
Loading