`uuid@^8.3.2` dependency is vulnerable (GHSA-w5hq-g745-h8pq); latest release still pins it

[AlbinoGeek]

node-notifier@10.0.1 (current latest) still declares:

"dependencies": {
  "uuid": "^8.3.2"
}

uuid@8.3.2 is affected by GHSA-w5hq-g745-h8pq (missing buffer bounds check in v3/v5/v6 when a buf is provided). The fix landed in uuid@11.1.1 — there is no patched release on the 8.x line, so this needs a major-version bump of the uuid dependency, not just a patch-range widen.

Any consumer of node-notifier currently has to carry a manual uuid override to clear this from npm audit/bun audit/yarn audit. Could the uuid dependency be bumped to ^11.1.1? Happy to open a PR if that's useful — wanted to check whether this is already tracked internally first.

[FeBe95]

Related:

• Drop uuid package #418

[AlbinoGeek]

Despite working in Open Source for 20+ years now, it still astounds me how we can have 5+ year old solutions to modern problems still either un-merged (best case) or not even investigated (most of the time.)

I mean what, crypto was added in NodeJS v0.3.6 (15 years ago) and full Web-compat crypto in 2020.

Thanks for pointing me to that though, that's 100% the correct solution; just removing uuid requirement entirely.

[AlbinoGeek]

Absolutely! We need to stop having random dependencies for literally no reason in open source. Don't need another shai hulud

…

On Mon, Sep 14, 2026, 20:12 Lancy ***@***.***> wrote: *lancy69* left a comment (mikaelbr/node-notifier#460) <#460 (comment)> Worth adding the deprecation angle: ***@***.*** is now deprecated outright, so consumers get this on *every* install, independent of the GHSA — npm warn deprecated ***@***.***: ***@***.*** and below is no longer supported. Blast radius is tiny, though. uuid is used in exactly one place, notifiers/toaster.js (Windows only), to generate a random pipe name: https://github.com/mikaelbr/node-notifier/blob/master/notifiers/toaster.js#L51 const { v4: uuid } = require('uuid');// ...return `${pathPrefix}${PIPE_NAME}-${uuid()}`; So #418 <#418> ( crypto.randomUUID()) is a one-line, no-behaviour-change fix rather than a major dependency bump. +1 for merging #418 <#418>. — Reply to this email directly, view it on GitHub <#460?email_source=notifications&email_token=AAOSNPLJ6ZLSTVZRJZHDZGD5PCXSXA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNRXGQYTAMRSGM2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5674102234>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOSNPNUWLNIEN3N5BK746T5PCXSXAVCNFSNUABDKJSXA33TNF2G64TZHM3DSNRVGUZDSO2JONZXKZJ3GUYTMMJWGY3DINZTUF3AE> . You are receiving this because you authored the thread.Message ID: ***@***.***>