-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Closed
Labels
Description
All versions of the UUID npm package < 7 have been deprecated due to a weakness in Math.random(). There are two packages in this repository that use the deprecated version.
- https://github.com/actions/toolkit/blob/main/packages/tool-cache/package.json#L44
- https://github.com/actions/toolkit/blob/main/packages/cache/package.json#L48
Any downstream package that depends on these packages will include the following line in their package-lock.json:
"deprecated": "Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.",
Can you upgrade node UUID to the latest released version? Happy to submit a PR to help you out.
jozefizso, DeLaGuardo, SukkaW, stevenwdv, evanjacover and 10 more