Skip to content

fix(deps): remove vulnerable dependency uuid#8120

Open
mhassan1 wants to merge 1 commit intogoogleapis:mainfrom
mhassan1:remove-uuid
Open

fix(deps): remove vulnerable dependency uuid#8120
mhassan1 wants to merge 1 commit intogoogleapis:mainfrom
mhassan1:remove-uuid

Conversation

@mhassan1
Copy link
Copy Markdown

@mhassan1 mhassan1 commented Apr 27, 2026

This PR removes vulnerable dependency uuid (GHSA-w5hq-g745-h8pq) in favor of crypto.randomUUID, which is available in all supported Node.js versions.

Fixes #7521.

@mhassan1 mhassan1 requested review from a team as code owners April 27, 2026 15:35
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request replaces the external uuid dependency with the native crypto.randomUUID() method across multiple packages. While the logic for generating UUIDs has been updated, several files are missing the necessary import or require statements for the crypto module, which will lead to runtime errors.

I am having trouble creating individual review comments. Click here to see my feedback.

core/paginator/test/index.ts (20)

high

The crypto module must be imported to use crypto.randomUUID(). Without this import, the code will throw a ReferenceError at runtime.

import * as crypto from 'crypto';

handwritten/bigquery-storage/system-test/managed_writer_client_test.ts (19)

high

The crypto module must be imported to use crypto.randomUUID(). This is a recurring issue across multiple files in this PR.

import * as crypto from 'crypto';

handwritten/bigtable/system-test/common.ts (15)

high

The crypto module must be imported to use crypto.randomUUID().

import * as crypto from 'crypto';

handwritten/error-reporting/system-test/error-reporting.ts (31)

high

The crypto module must be imported to use crypto.randomUUID().

import * as crypto from 'crypto';

handwritten/logging-bunyan/system-test/logging-bunyan.ts (20)

high

The crypto module must be imported to use crypto.randomUUID().

import * as crypto from 'crypto';

handwritten/pubsub/test/message-queues.ts (22)

high

The crypto module must be imported to use crypto.randomUUID().

import * as crypto from 'crypto';

handwritten/spanner/test/codec.ts (27)

high

The crypto module must be imported to use crypto.randomUUID().

import * as crypto from 'crypto';

handwritten/storage/src/nodejs-common/service.ts (23)

high

The crypto module must be imported to use crypto.randomUUID().

import * as crypto from 'crypto';

packages/google-cloud-compute/system-test/compute.js (19)

high

The crypto module must be required to use crypto.randomUUID() in this CommonJS file.

const crypto = require('crypto');

packages/google-cloud-dialogflow-cx/samples/quickstart.js (49-51)

high

The crypto module must be required to use crypto.randomUUID(). The previous comments regarding the uuid module should also be removed as they are no longer applicable.

  const crypto = require('crypto');

packages/google-cloud-dns/samples/test/quickstart.test.js (21)

high

The crypto module must be required to use crypto.randomUUID().

const crypto = require('crypto');

packages/google-cloud-secretmanager/samples/test/quickstart.test.js (19)

high

The crypto module must be required to use crypto.randomUUID().

const crypto = require('crypto');

packages/google-storagetransfer/samples/test/utils/bucket.js (25)

high

The crypto module must be required to use crypto.randomUUID().

const crypto = require('crypto');

@mhassan1
Copy link
Copy Markdown
Author

mhassan1 commented May 6, 2026

While the logic for generating UUIDs has been updated, several files are missing the necessary import or require statements for the crypto module, which will lead to runtime errors.

I've addressed this by adding crypto imports in all the changed files.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

migrate from uuid to use randomUUID from the crypto module

1 participant