test: use node:crypto randomUUID instead of uuid dependency by fengmk2 · Pull Request #143 · node-modules/compressing

fengmk2 · 2026-08-05T12:52:49Z

The uuid package was a devDependency only used to generate temp file names in tests. Node's built-in crypto.randomUUID() covers this since Node 14.17 and the package requires Node >= 18, so this drops the dependency entirely.

This also resolves the CVE-2026-41907 advisory flagged by Renovate, making #139 obsolete.

Verified with npm run lint and npm run test:js (171 passing, 3 pending).

Summary by CodeRabbit

Chores
- Removed the unused UUID development dependency.
- Updated temporary test file and directory generation to use Node.js’s built-in UUID support.
Tests
- Preserved existing archive, extraction, streaming, and security test behavior while improving temporary path isolation.

The uuid package was a devDependency only used to generate temp file names in tests. Node's built-in crypto.randomUUID() covers this since Node 14.17 and the package requires Node >= 18. Removing the dependency also resolves the CVE-2026-41907 advisory flagged by Renovate in #139.

coderabbitai · 2026-08-05T12:53:15Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d45bdf60-1fa8-4299-afec-b1c76f7b0244

📥 Commits

Reviewing files that changed from the base of the PR and between 5c725e6 and e7c3c16.

📒 Files selected for processing (19)

package.json
test/gzip/file_stream.test.js
test/gzip/index.test.js
test/gzip/uncompress_stream.test.js
test/tar/file_stream.test.js
test/tar/index.test.js
test/tar/security-GHSA-4c3q-x735-j3r5.test.js
test/tar/security-GHSA-cc8f-xg8v-72m3.test.js
test/tar/stream.test.js
test/tar/symlink-resolution.test.js
test/tar/uncompress_stream.test.js
test/tgz/file_stream.test.js
test/tgz/index.test.js
test/tgz/stream.test.js
test/tgz/uncompress_stream.test.js
test/zip/file_stream.test.js
test/zip/index.test.js
test/zip/stream.test.js
test/zip/uncompress_stream.test.js

📝 Walkthrough

Walkthrough

Changes

The test suite replaces uuid.v4() with Node.js randomUUID() for temporary gzip, TAR, TGZ, and ZIP paths. uuid is removed from devDependencies.

UUID dependency and gzip tests

Layer / File(s)	Summary
Dependency removal and gzip path generation `package.json`, `test/gzip/*`	The `uuid` development dependency is removed. Gzip tests use `randomUUID()` for temporary paths.

TAR tests

Layer / File(s)	Summary
TAR temporary path generation `test/tar/*`	TAR tests use `randomUUID()` for temporary archives and extraction directories. Existing assertions remain unchanged.

TGZ tests

Layer / File(s)	Summary
TGZ temporary path generation `test/tgz/*`	TGZ tests use `randomUUID()` for temporary archives and extraction directories.

ZIP tests

Layer / File(s)	Summary
ZIP temporary path generation `test/zip/*`	ZIP tests use `randomUUID()` for temporary archives and extraction directories.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: replacing the test-only uuid dependency with Node.js node:crypto randomUUID.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/replace-uuid-with-node-crypto

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

Parsing error: Unexpected token :

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

🟢 Ready to approve

The change is limited to tests and devDependencies, and repository-wide searches show no remaining uuid references after the switch to crypto.randomUUID().

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR removes the uuid devDependency by switching test-only temporary file/directory name generation to Node’s built-in crypto.randomUUID(), aligning with the project’s Node >= 18 engine requirement and addressing the Renovate advisory context.

Changes:

Replaced uuid.v4() usage in test suites with randomUUID() from node:crypto.
Removed uuid from devDependencies in package.json.

File summaries

File	Description
test/zip/uncompress_stream.test.js	Switch temp destination directory naming from `uuid.v4()` to `randomUUID()` for zip uncompress stream tests.
test/zip/stream.test.js	Switch temp destination zip filename generation from `uuid.v4()` to `randomUUID()`.
test/zip/index.test.js	Switch zip test temp dir/file naming from `uuid.v4()` to `randomUUID()` across multiple cases.
test/zip/file_stream.test.js	Switch temp destination zip filename generation from `uuid.v4()` to `randomUUID()`.
test/tgz/uncompress_stream.test.js	Switch temp destination directory naming from `uuid.v4()` to `randomUUID()` for tgz uncompress stream tests.
test/tgz/stream.test.js	Switch temp destination tgz filename generation from `uuid.v4()` to `randomUUID()`.
test/tgz/index.test.js	Switch tgz test temp dir/file naming from `uuid.v4()` to `randomUUID()` across multiple cases.
test/tgz/file_stream.test.js	Switch temp destination tgz filename generation from `uuid.v4()` to `randomUUID()`.
test/tar/uncompress_stream.test.js	Switch temp destination directory naming from `uuid.v4()` to `randomUUID()` for tar uncompress stream tests.
test/tar/symlink-resolution.test.js	Switch per-test temp directory naming from `uuid.v4()` to `randomUUID()`.
test/tar/stream.test.js	Switch temp destination tar filename generation from `uuid.v4()` to `randomUUID()`.
test/tar/security-GHSA-cc8f-xg8v-72m3.test.js	Switch per-test temp directory naming from `uuid.v4()` to `randomUUID()` in security regression test.
test/tar/security-GHSA-4c3q-x735-j3r5.test.js	Switch per-test temp directory naming from `uuid.v4()` to `randomUUID()` in security regression test.
test/tar/index.test.js	Switch tar test temp dir/file naming from `uuid.v4()` to `randomUUID()` across multiple cases.
test/tar/file_stream.test.js	Switch temp destination tar filename generation from `uuid.v4()` to `randomUUID()`.
test/gzip/uncompress_stream.test.js	Switch temp destination output filename generation from `uuid.v4()` to `randomUUID()` for gzip uncompress stream tests.
test/gzip/index.test.js	Switch gzip test temp output filename generation from `uuid.v4()` to `randomUUID()` across multiple cases.
test/gzip/file_stream.test.js	Switch temp gzip output filename generation from `uuid.v4()` to `randomUUID()` across multiple cases.
package.json	Remove `uuid` from `devDependencies`.

Review details

Files reviewed: 19/19 changed files
Comments generated: 0
Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

codecov · 2026-08-05T12:56:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.15%. Comparing base (5c725e6) to head (e7c3c16).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #143   +/-   ##
=======================================
  Coverage   97.15%   97.15%           
=======================================
  Files          19       19           
  Lines        1197     1197           
  Branches      309      309           
=======================================
  Hits         1163     1163           
  Misses         34       34

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[skip ci] ## <small>2.1.2 (2026-08-05)</small> * test: use node:crypto randomUUID instead of uuid dependency (#143) ([c0d269f](c0d269f)), closes [#143](#143) [#139](#139) * ci: add Node.js 26 to the test matrix (#141) ([5c725e6](5c725e6)), closes [#141](#141) [#140](#140) * fix: resolve symlink chains fully when extracting (#140) ([72a3c84](72a3c84)), closes [#140](#140)

github-actions · 2026-08-05T13:03:37Z

🎉 This PR is included in version 2.1.2 🎉

The release is available on:

Your semantic-release bot 📦🚀

Copilot AI lite review requested due to automatic review settings August 5, 2026 12:52

Copilot started reviewing on behalf of fengmk2 August 5, 2026 12:53 View session

fengmk2 mentioned this pull request Aug 5, 2026

chore(deps): update dependency uuid to v11 [security] #139

Closed

1 task

Copilot AI approved these changes Aug 5, 2026

View reviewed changes

fengmk2 merged commit c0d269f into master Aug 5, 2026
20 of 23 checks passed

fengmk2 deleted the chore/replace-uuid-with-node-crypto branch August 5, 2026 13:02

github-actions Bot added the released label Aug 5, 2026

Navigation Menu

Uh oh!

test: use node:crypto randomUUID instead of uuid dependency - #143

test: use node:crypto randomUUID instead of uuid dependency#143
fengmk2 merged 1 commit into
masterfrom
chore/replace-uuid-with-node-crypto

fengmk2 commented Aug 5, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Uh oh!

codecov Bot commented Aug 5, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

fengmk2 commented Aug 5, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Ready to approve

Uh oh!

codecov Bot commented Aug 5, 2026

Codecov Report

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fengmk2 commented Aug 5, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading