toolkit
toolkit copied to clipboard
Upgrade uuid
trafficstars
Fixes #925
Bump to this 👀
Yarn v4 was released on October 22nd, and yarn npm audit --all --recursive doesn't pass on packages such as @actions/cache that depend on deprecated packages like uuid v6 and earlier.
└─ uuid
├─ ID: uuid (deprecation)
├─ Issue: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
├─ Severity: moderate
├─ Vulnerable Versions: 3.4.0
│
├─ Tree Versions
│ └─ 3.4.0
│
└─ Dependents
└─ @actions/cache@npm:3.2.2
can we not just use randomUUID from webcrypto? GH Actions anyway use node 20: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/randomUUID
Replaced by #1824