Skip to content

Conversation

@daveisfera
Copy link

Fixes #925

@daveisfera daveisfera requested review from a team as code owners October 25, 2023 18:02
@peterdeme
Copy link

Bump to this 👀

@Kurt-von-Laven
Copy link
Contributor

Yarn v4 was released on October 22nd, and yarn npm audit --all --recursive doesn't pass on packages such as @actions/cache that depend on deprecated packages like uuid v6 and earlier.

└─ uuid
   ├─ ID: uuid (deprecation)
   ├─ Issue: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
   ├─ Severity: moderate
   ├─ Vulnerable Versions: 3.4.0
   │ 
   ├─ Tree Versions
   │  └─ 3.4.0
   │ 
   └─ Dependents
      └─ @actions/cache@npm:3.2.2
@shyim
Copy link

shyim commented Jan 14, 2024

can we not just use randomUUID from webcrypto? GH Actions anyway use node 20:
https://developer.mozilla.org/en-US/docs/Web/API/Crypto/randomUUID

Copy link
Contributor

@joshmgross joshmgross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👋 Thank you for your contribution!

As suggested by #1571 (comment) and #925 (comment), I think it would be best to remove this dependency entirely in favor of the built-in crypto.randomUUID.

I put up a PR with that change #1824

@joshmgross
Copy link
Contributor

Replaced by #1824

@joshmgross joshmgross closed this Oct 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

5 participants