`uuid@^8.3.2` dependency is vulnerable (GHSA-w5hq-g745-h8pq); latest release still pins it

Open Beginner friendly
#460 4 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript, nodejs
Domain
security, tooling

Research direction

Start with the dependency declaration shown for node-notifier@10.0.1 and check uuid@^11.1.1 for compatibility with the project. Verify the dependency update clears GHSA-w5hq-g745-h8pq in npm audit, bun audit, or yarn audit, while the existing project checks continue to pass.

Written by the indexing model from the issue text.

Description

node-notifier@10.0.1 (current latest) still declares:

"dependencies": {
  "uuid": "^8.3.2"
}

uuid@8.3.2 is affected by GHSA-w5hq-g745-h8pq (missing buffer bounds check in v3/v5/v6 when a buf is provided). The fix landed in uuid@11.1.1 — there is no patched release on the 8.x line, so this needs a major-version bump of the uuid dependency, not just a patch-range widen.

Any consumer of node-notifier currently has to carry a manual uuid override to clear this from npm audit/bun audit/yarn audit. Could the uuid dependency be bumped to ^11.1.1? Happy to open a PR if that's useful — wanted to check whether this is already tracked internally first.

Dominant language
JavaScript
Stars
5.8k
Forks
319
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from mikaelbr/node-notifier

All issues in mikaelbr/node-notifier

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.