Skip to content

fix(OAA-5522): upgrade uuid to ^11.1.1 (SNYK-JS-UUID-16133035) - #14

Merged
rahul-contentstack merged 2 commits into
masterfrom
fix/OAA-5522-uuid
Oct 16, 2026
Merged

rahul-contentstack merged 2 commits into
masterfrom
fix/OAA-5522-uuid

Conversation

@rahul-contentstack

Copy link
Copy Markdown

Why

epicurus-node@0.3.8 pins uuid@3.2.1, which is affected by SNYK-JS-UUID-16133035 (fixed in 11.1.1). Every service on 0.3.8 is flagged, including cma-api, auth-service and superadmin-api.

Tickets: CMA-22178 (Sev-2 Snyk, SLA breached), OAA-5522

Changes

  • uuid 3.2.1 → ^11.1.1; removed @types/uuid (uuid 11 ships its own types)
  • ts/lib/request_response/index.ts: import * as v4 from 'uuid/v4' → import { v4 } from 'uuid'
  • Version 0.3.8 → 0.3.9

The committed js/ build output is unchanged. The publish workflow rebuilds it from ts/ (npm run compile) before publishing.

Testing

  • npm run compile passes (TypeScript 2.8.1)
  • npm test: 11/11 passing across 7 consecutive runs against a local Redis 7

Heads-up

  • Merging to master auto-publishes 0.3.9 via publish-epicurus-package.yml.
  • uuid 11 needs a much newer Node than uuid 3. Consumers on older Node versions should check their runtime before bumping.

🤖 Generated with Claude Code

- uuid 3.2.1 -> ^11.1.1 (fixes SNYK-JS-UUID-16133035, CMA-22178)
- remove @types/uuid; uuid 11 ships its own types
- import { v4 } from 'uuid' instead of 'uuid/v4'
- bump version 0.3.8 -> 0.3.9

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@rahul-contentstack
rahul-contentstack requested a review from a team as a code owner October 16, 2026 04:08
@snyk-io

snyk-io Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Fixes the security-license policy check, which requires the current year.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@cs-bala cs-bala left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@rahul-contentstack
rahul-contentstack merged commit 597c872 into master Oct 16, 2026
9 checks passed
@rahul-contentstack
rahul-contentstack deleted the fix/OAA-5522-uuid branch October 16, 2026 06:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants