From df482c9cf221ad4bfa2c449c5b1826fbe1e23315 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 26 Apr 2026 00:48:53 +0800 Subject: [PATCH] chore: bump up uuid version to v14 [SECURITY] (#14870) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [uuid](https://redirect.github.com/uuidjs/uuid) | [`^13.0.0` → `^14.0.0`](https://renovatebot.com/diffs/npm/uuid/13.0.0/14.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/uuid/14.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/uuid/13.0.0/14.0.0?slim=true) | --- ### uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided [GHSA-w5hq-g745-h8pq](https://redirect.github.com/advisories/GHSA-w5hq-g745-h8pq)
More information #### Details ##### Summary `v3`, `v5`, and `v6` accept external output buffers but do not reject out-of-range writes (small `buf` or large `offset`). By contrast, `v4`, `v1`, and `v7` explicitly throw `RangeError` on invalid bounds. This inconsistency allows **silent partial writes** into caller-provided buffers. ##### Affected code - `src/v35.ts` (`v3`/`v5` path) writes `buf[offset + i]` without bounds validation. - `src/v6.ts` writes `buf[offset + i]` without bounds validation. ##### Reproducible PoC ```bash cd /home/StrawHat/uuid npm ci npm run build node --input-type=module -e " import {v4,v5,v6} from './dist-node/index.js'; const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8'; for (const [name,fn] of [ ['v4',()=>v4({},new Uint8Array(8),4)], ['v5',()=>v5('x',ns,new Uint8Array(8),4)], ['v6',()=>v6({},new Uint8Array(8),4)], ]) { try { fn(); console.log(name,'NO_THROW'); } catch(e){ console.log(name,'THREW',e.name); } }" ``` Observed: - `v4 THREW RangeError` - `v5 NO_THROW` - `v6 NO_THROW` Example partial overwrite evidence captured during audit: ```text same true buf [ 170, 170, 170, 170, 75, 224, 100, 63 ] v6 [ 187, 187, 187, 187, 31, 19, 185, 64 ] ``` ##### Security impact - **Primary**: integrity/robustness issue (silent partial output). - If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error. - In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw. ##### Suggested fix Add the same guard used by `v4`/`v1`/`v7`: ```ts if (offset < 0 || offset + 16 > buf.length) { throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); } ``` Apply to: - `src/v35.ts` (covers `v3` and `v5`) - `src/v6.ts` #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq](https://redirect.github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq) - [https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34](https://redirect.github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34) - [https://github.com/uuidjs/uuid/releases/tag/v14.0.0](https://redirect.github.com/uuidjs/uuid/releases/tag/v14.0.0) - [https://github.com/advisories/GHSA-w5hq-g745-h8pq](https://redirect.github.com/advisories/GHSA-w5hq-g745-h8pq) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-w5hq-g745-h8pq) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
--- ### Release Notes
uuidjs/uuid (uuid) ### [`v14.0.0`](https://redirect.github.com/uuidjs/uuid/blob/HEAD/CHANGELOG.md#1400-2026-04-19) [Compare Source](https://redirect.github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0) ##### Security - Fixes [GHSA-w5hq-g745-h8pq](https://redirect.github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq): `v3()`, `v5()`, and `v6()` did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid `offset` was provided. A `RangeError` is now thrown if `offset < 0` or `offset + 16 > buf.length`. ##### ⚠ BREAKING CHANGES - `crypto` is now expected to be globally defined (requires node\@​20+) ([#​935](https://redirect.github.com/uuidjs/uuid/issues/935)) - drop node\@​18 support ([#​934](https://redirect.github.com/uuidjs/uuid/issues/934)) - upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- packages/common/nbstore/package.json | 2 +- .../frontend/apps/electron-renderer/package.json | 2 +- packages/frontend/apps/electron/package.json | 2 +- yarn.lock | 14 +++++++------- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/packages/common/nbstore/package.json b/packages/common/nbstore/package.json index 843a61779..314595a6d 100644 --- a/packages/common/nbstore/package.json +++ b/packages/common/nbstore/package.json @@ -25,7 +25,7 @@ "lodash-es": "^4.17.23", "nanoid": "^5.1.6", "rxjs": "^7.8.2", - "uuid": "^13.0.0", + "uuid": "^14.0.0", "y-protocols": "^1.0.6", "yjs": "^13.6.27" }, diff --git a/packages/frontend/apps/electron-renderer/package.json b/packages/frontend/apps/electron-renderer/package.json index 1e0beb81f..c86e0b5eb 100644 --- a/packages/frontend/apps/electron-renderer/package.json +++ b/packages/frontend/apps/electron-renderer/package.json @@ -24,7 +24,7 @@ "react": "^19.2.1", "react-dom": "^19.2.1", "react-router-dom": "^6.30.3", - "uuid": "^13.0.0" + "uuid": "^14.0.0" }, "devDependencies": { "@types/react": "^19.0.1", diff --git a/packages/frontend/apps/electron/package.json b/packages/frontend/apps/electron/package.json index a5dcd42a6..5ada266c4 100644 --- a/packages/frontend/apps/electron/package.json +++ b/packages/frontend/apps/electron/package.json @@ -70,7 +70,7 @@ "semver": "^7.7.3", "tree-kill": "^1.2.2", "typescript": "^5.9.3", - "uuid": "^13.0.0", + "uuid": "^14.0.0", "vitest": "^4.0.18", "zod": "^3.25.76" }, diff --git a/yarn.lock b/yarn.lock index cb7297548..7aef1eaec 100644 --- a/yarn.lock +++ b/yarn.lock @@ -535,7 +535,7 @@ __metadata: react-dom: "npm:^19.2.1" react-router-dom: "npm:^6.30.3" typescript: "npm:^5.9.3" - uuid: "npm:^13.0.0" + uuid: "npm:^14.0.0" languageName: unknown linkType: soft @@ -585,7 +585,7 @@ __metadata: set-cookie-parser: "npm:^2.7.1" tree-kill: "npm:^1.2.2" typescript: "npm:^5.9.3" - uuid: "npm:^13.0.0" + uuid: "npm:^14.0.0" vitest: "npm:^4.0.18" yjs: "npm:^13.6.27" zod: "npm:^3.25.76" @@ -827,7 +827,7 @@ __metadata: nanoid: "npm:^5.1.6" rxjs: "npm:^7.8.2" socket.io-client: "npm:^4.8.3" - uuid: "npm:^13.0.0" + uuid: "npm:^14.0.0" vitest: "npm:^4.0.18" y-protocols: "npm:^1.0.6" yjs: "npm:^13.6.27" @@ -34681,12 +34681,12 @@ __metadata: languageName: node linkType: hard -"uuid@npm:^13.0.0": - version: 13.0.0 - resolution: "uuid@npm:13.0.0" +"uuid@npm:^14.0.0": + version: 14.0.0 + resolution: "uuid@npm:14.0.0" bin: uuid: dist-node/bin/uuid - checksum: 10/2742b24d1e00257e60612572e4d28679423469998cafbaf1fe9f1482e3edf9c40754b31bfdb3d08d71b29239f227a304588f75210b3b48f2609f0673f1feccef + checksum: 10/8ee9b98f9650e25555515f7a28d3c3ae9364e72f7bb19b9e08b681bc135338beba5509b2830f6ae1cfaba4d45401da0d16d4d109b977097bc3d6ba0c5583341b languageName: node linkType: hard