Repository navigation
fix: Restore uuid to v11.1.1 - #1496
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approval recommended
The manifest and lockfile agree, and the plugin’s existing UUID v4 usage remains compatible.
0 open findings
What changed in this PR
Reverts the Babel plugin’s UUID upgrade from #1490 to restore host-app builds on Node.js versions older than 22.12.
Changes:
- Restores the
uuiddependency range to^8.3.2. - Updates the lockfile to resolve UUID 8.3.2 instead of 14.0.3.
| File | Description |
|---|---|
| yarn.lock | Restores the UUID 8.3.2 resolution. |
| packages/react-native-babel-plugin/package.json | Restores the compatible UUID dependency range. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80e4690c1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "fast-glob": "^3.3.3", | ||
| "svgo": "^4.1.0", | ||
| "uuid": "^14.0.3" | ||
| "uuid": "^8.3.2" |
There was a problem hiding this comment.
Every published plugin installation now pulls uuid 8.3.2, which is within the <11.1.1 affected range for GHSA-w5hq-g745-h8pq. Although this plugin currently invokes only the unaffected v4() API, consumers that enforce dependency-vulnerability gates will reject the package; uuid 11.1.1 backported the security fix while retaining CommonJS support, so that version can address the older-Node/CommonJS regression without restoring a known-vulnerable direct dependency.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
@cdn34dd Would it be safe for us to do this?, updating to 11.1.1 would be an improvement, but I don't know if something else would break on the babel plugin if we did.
What does this PR do?
Reverts changes done by #1490
The bump broke host app builds using the babel plugin while being built with node.js versions older than 22.12.
Motivation
The SDK should not break host app builds.
Review checklist (to be filled by reviewers)