Drop `uuid` and bump vulnerable transitives for `@kurrent/kurrentdb-client` by George-Payne · Pull Request #499 · kurrent-io/KurrentDB-Client-NodeJS

George-Payne · 2026-05-04T14:59:45Z

Resolves the dependabot security alerts that affect the published library. Closes the open dependabot PRs (#487, #488, #489, #490, #491, #498) in one bundle so they land coherently and CI passes (the originals failed because dependabot's lockfile changes don't survive yarn 4 hardened-mode post-resolution validation).

Replace `uuid` with `crypto.randomUUID`

crypto.randomUUID has been available since Node 14.17, the package requires Node >= 20. This drops uuid and @types/uuid from both db-client and test.

Replace uuid.stringify in grpcUUID.ts with a new structuredUUIDToString helper that computes the canonical UUID string directly from the proto's msb/lsb int64 strings. The mask & ((1n << 64n) - 1n) reinterprets two's-complement negatives as unsigned, which incidentally fixes a latent bug: the previous setBigUint64 path threw RangeError on any UUID whose first or 9th byte was >= 0x80.
Add packages/test/src/extra/grpcUUID.test.ts covering structuredUUIDToString and parseUUID.

Bump vulnerable transitives in yarn.lock

Package	From	To	Severity
protobufjs	7.4.0	7.5.5	critical
axios	1.7.9	1.15.1	high
follow-redirects	1.15.9	1.16.0	medium
protocol-buffers-schema	3.6.0	3.6.1	medium

Cherry-picked from the open dependabot PRs, then yarn install to reconcile the lockfile. Followed by yarn dedupe for additional cleanup.

The repo requires Node >=20, so the bundled crypto.randomUUID covers all uuid v4 generation. Drops the uuid dep entirely. - Swap v4() callsites in db-client and test to randomUUID - Replace uuid.stringify in grpcUUID with structuredUUIDToString, computing the canonical UUID string directly from the proto's msb/lsb int64 strings (mask handles two's-complement negatives, which the previous setBigUint64 path threw on) - Add grpcUUID.test.ts covering structuredUUIDToString and parseUUID - Remove uuid and @types/uuid from db-client and test packages

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.9 to 1.16.0. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.0) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [protocol-buffers-schema](https://github.com/mafintosh/protocol-buffers-schema) from 3.6.0 to 3.6.1. - [Commits](mafintosh/protocol-buffers-schema@v3.6.0...v3.6.1) --- updated-dependencies: - dependency-name: protocol-buffers-schema dependency-version: 3.6.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 7.4.0 to 7.5.5. - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.4.0...protobufjs-v7.5.5) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 7.5.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [axios](https://github.com/axios/axios) from 1.7.9 to 1.15.1. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.9...v1.15.1) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

qodo-code-review · 2026-05-04T15:00:03Z

Review Summary by Qodo

Replace uuid with crypto.randomUUID and bump vulnerable dependencies

✨ Enhancement 🐞 Bug fix

Walkthroughs

Description

• Replace uuid dependency with native crypto.randomUUID
• Fix latent bug in UUID parsing with high bit set
• Add comprehensive test coverage for UUID utilities
• Bump vulnerable transitive dependencies to secure versions

Diagram

flowchart LR
  A["uuid v11.0.3"] -->|"Replace with"| B["crypto.randomUUID"]
  C["Old UUID parsing<br/>setBigUint64 throws"] -->|"Fix with"| D["structuredUUIDToString<br/>with bit masking"]
  E["Vulnerable transitives<br/>protobufjs, axios, etc."] -->|"Bump to secure"| F["Updated versions<br/>in yarn.lock"]
  B --> G["Reduced dependencies<br/>Node >=20 only"]
  D --> H["New grpcUUID.test.ts<br/>test coverage"]

File Changes

1. packages/db-client/src/Client/index.ts ✨ Enhancement +2/-2

Replace uuid import with crypto.randomUUID

packages/db-client/src/Client/index.ts

2. packages/db-client/src/events/binaryEvent.ts ✨ Enhancement +2/-2

Replace uuid v4 with randomUUID

packages/db-client/src/events/binaryEvent.ts

3. packages/db-client/src/events/jsonEvent.ts ✨ Enhancement +2/-2

Replace uuid v4 with randomUUID

packages/db-client/src/events/jsonEvent.ts

View more (19)

4. packages/db-client/src/streams/appendToStream/batchAppend.ts ✨ Enhancement +2/-2

Replace uuid v4 with randomUUID

packages/db-client/src/streams/appendToStream/batchAppend.ts

5. packages/db-client/src/utils/grpcUUID.ts 🐞 Bug fix +16/-14

Refactor UUID parsing with bit masking fix

packages/db-client/src/utils/grpcUUID.ts

6. packages/test/src/connection/determineBestNode.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/connection/determineBestNode.test.ts

7. packages/test/src/extra/dispose.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/extra/dispose.test.ts

8. packages/test/src/extra/grpcUUID.test.ts 🧪 Tests +48/-0

Add comprehensive UUID utility test coverage

packages/test/src/extra/grpcUUID.test.ts

9. packages/test/src/extra/http2-assertion-failure.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/extra/http2-assertion-failure.test.ts

10. packages/test/src/extra/typedEvents-more.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/extra/typedEvents-more.test.ts

11. packages/test/src/opentelemetry/instrumentation.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/opentelemetry/instrumentation.test.ts

12. packages/test/src/persistentSubscription/subscribeToPersistentSubscriptionToStream.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/persistentSubscription/subscribeToPersistentSubscriptionToStream.test.ts

13. packages/test/src/samples/appending-events.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/samples/appending-events.ts

14. packages/test/src/samples/get-started.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/samples/get-started.ts

15. packages/test/src/samples/opentelemetry.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/samples/opentelemetry.ts

16. packages/test/src/samples/projection-management.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/samples/projection-management.ts

17. packages/test/src/samples/user-certificates.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/samples/user-certificates.ts

18. packages/test/src/streams/appendRecords.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/streams/appendRecords.test.ts

19. packages/test/src/streams/multiAppendStream.test.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/streams/multiAppendStream.test.ts

20. packages/test/src/utils/Cluster.ts ✨ Enhancement +1/-1

Replace uuid import with crypto.randomUUID

packages/test/src/utils/Cluster.ts

21. packages/db-client/package.json Dependencies +1/-3

Remove uuid and @types/uuid dependencies

packages/db-client/package.json

22. packages/test/package.json Dependencies +1/-3

Remove uuid and @types/uuid dependencies

packages/test/package.json

qodo-code-review · 2026-05-04T15:00:05Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. Ambiguous crypto module import 🐞 Bug ⛨ Security

Description

New code imports randomUUID from "crypto", which can be polyfilled/shadowed by some bundlers or
non-standard resolvers, changing UUID generation semantics. Since the package requires Node >=20,
using "node:crypto" makes the builtin dependency unambiguous across all new call sites.

Code

packages/db-client/src/utils/grpcUUID.ts[1]
+import { randomUUID } from "crypto";

Evidence

The PR introduces multiple import { randomUUID } from "crypto" call sites (example shown in
grpcUUID.ts). The library explicitly requires Node >=20, so node:crypto is always available and
avoids any chance of resolving to a userland/polyfilled crypto implementation in build pipelines
that rewrite/alias Node builtins.

packages/db-client/src/utils/grpcUUID.ts[1-4]
packages/db-client/package.json[44-46]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Several files now import `randomUUID` from the bare specifier `"crypto"`. In environments with bundler aliasing/polyfills, that specifier can resolve to a non-builtin implementation.

## Issue Context
This package already requires Node.js >= 20, where the `node:` builtin specifier is supported and recommended to force builtin resolution.

## Fix Focus Areas
- packages/db-client/src/utils/grpcUUID.ts[1-1]
- packages/db-client/src/Client/index.ts[6-6]
- packages/db-client/src/events/binaryEvent.ts[1-1]
- packages/db-client/src/events/jsonEvent.ts[1-1]
- packages/db-client/src/streams/appendToStream/batchAppend.ts[1-1]
- (Optionally, apply consistently across tests too)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

w1am

LGTM

github-actions

@w1am 👉 Created pull request targeting release/v1.2: #500

George-Payne and others added 6 commits May 4, 2026 16:29

Run yarn dedupe

5d9abdb

George-Payne requested a review from w1am May 4, 2026 14:59

George-Payne self-assigned this May 4, 2026

George-Payne added the dependencies Pull requests that update a dependency file label May 4, 2026

w1am added the cherry-pick:release/v1.2 label May 5, 2026

w1am approved these changes May 5, 2026

View reviewed changes

w1am merged commit fb8c5ba into master May 5, 2026
30 checks passed

w1am deleted the dependahuman branch May 5, 2026 06:20

github-actions Bot mentioned this pull request May 5, 2026

[release/v1.2] Drop uuid and bump vulnerable transitives for @kurrent/kurrentdb-client #500

Merged

github-actions Bot reviewed May 5, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Drop `uuid` and bump vulnerable transitives for `@kurrent/kurrentdb-client`#499

Drop `uuid` and bump vulnerable transitives for `@kurrent/kurrentdb-client`#499
w1am merged 6 commits intomasterfrom
dependahuman

George-Payne commented May 4, 2026

Uh oh!

qodo-code-review Bot commented May 4, 2026

Uh oh!

qodo-code-review Bot commented May 4, 2026 •

edited

Loading

Uh oh!

w1am left a comment

Uh oh!

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

George-Payne commented May 4, 2026

Replace uuid with crypto.randomUUID

Bump vulnerable transitives in yarn.lock

Uh oh!

qodo-code-review Bot commented May 4, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

qodo-code-review Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

w1am left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Replace `uuid` with `crypto.randomUUID`

qodo-code-review Bot commented May 4, 2026 •

edited

Loading