chore(deps): bump uuid from 9.0.1 to 14.0.1

[dependabot]

Bumps uuid from 9.0.1 to 14.0.1.

Release notes

Sourced from uuid's releases.

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

• expect crypto to be global everywhere (requires node@20+) (#935)
• drop node@18 support (#934)

Features

• drop node@18 support (#934) (dc4ddb8)

Bug Fixes

• expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
• Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

• rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

• backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

• Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

• crypto is now expected to be globally defined (requires node@20+) (#935)
• drop node@18 support (#934)
• upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

Bug Fixes

• make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

• update to typescript@5.2 (#887)
• remove CommonJS support (#886)
• drop node@16 support (#883)

Features

• add node@24 to ci matrix (#879) (42b6178)
• drop node@16 support (#883) (0f38cf1)
• remove CommonJS support (#886) (ae786e2)
• update to typescript@5.2 (#887) (c7ee405)

Bug Fixes

... (truncated)

Commits

• 7017780 chore(main): release 14.0.1 (#964)
• f2c3e4b chore: fix release-please workflow (#963)
• 27ffae5 fix: add types condition to node export for moduleResolution bundler (#961)
• 664cb31 Remove outdated security contact information (#959)
• d729016 fix(ci): checkout PR head commit in browser workflow (#957)
• 89a5ebc Workflows (#948)
• 196e208 chore: fix workflow (#947)
• 95af448 chore: update workflows (#946)
• 3b57f95 chore: add workflow_dispatch (#944)
• a433096 chore: add 12.x and 13.x maintenance release branches (#941)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Upgrade uuid from 9.0.1 to 14.0.1 to pick up security fixes and modern ESM output. This requires Node.js 20+ and may need import updates.

• Dependencies

  • Bump uuid to 14.0.1.
  • Includes security fix for GHSA-w5hq-g745-h8pq and a types export fix.
  • Drops Node 18 support; expects global crypto. ESM-only since v12 (no CommonJS).

• Migration

  • Run on Node.js 20+.
  • Use ESM imports: import { v4 as uuidv4 } from 'uuid' (replace require('uuid')).
  • If using v3, v5, or v6 with buffers, handle RangeError for invalid offsets.
  • If using TypeScript, ensure v5.4.3 or newer.

^{Written for commit c7bbcf6. Summary will update on new commits.}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This is a dependabot PR bumping uuid from 9.0.1 to 14.0.1. The diff only contains package.json and package-lock.json changes with no source code modifications.

Observations

• The uuid package is listed as a dependency but is NOT imported or used in the codebase (src/index.js uses native crypto.randomUUID() instead)
• The upgrade includes a security fix for GHSA-w5hq-g745-h8pq (buffer bounds validation in v3/v5/v6)
• uuid v14 requires Node.js 20+ and is ESM-only since v12 (no CommonJS). Verify your deployment environment uses Node.js 20+.

Optional Recommendation

Since the uuid package is unused, consider removing it entirely to reduce dependencies, or keep this bump if you plan to use it in the future.

Files Reviewed (2 files)

• package.json - dependency version change
• package-lock.json - lock file update

---

_{Reviewed by laguna-m.1-20260312:free · Input: 411K · Output: 2.6K · Cached: 96.6K}