Skip to content

[MEDIUM] Pin uuid to 11.1.1 - #58347

Open
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-uuid
Open

OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-uuid

Conversation

@OskarEichler

@OskarEichler OskarEichler commented Sep 4, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • resolve jest-junit’s uuid dependency to 11.1.1
  • keep the change scoped to the test-reporting toolchain
  • verify that Jest still produces its JUnit report with the newer uuid API

Security impact

uuid 8.3.2 is affected by GHSA-w5hq-g745-h8pq, which lacks bounds checks in namespace-based UUID generation when a caller supplies an output buffer. The targeted resolution is needed because jest-junit still requests the affected 8.x line.

Test Plan

  • yarn install --frozen-lockfile --ignore-scripts
  • yarn why uuid confirmed only 11.1.1
  • yarn audit no longer reports the uuid advisory
  • Jest with the jest-junit reporter: 14 tests passed and a non-empty JUnit XML report was generated
  • git diff --check

Changelog:

[INTERNAL] [SECURITY] - Pin uuid to 11.1.1.

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 4, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Sep 4, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant