chore(deps): bump uuid from 9.0.1 to 14.0.2 in /packages/profile-metrics-controller in the npm_and_yarn group across 1 directory - #10177
Open
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/packages/profile-metrics-controller/npm_and_yarn-115a665413
branch
2 times, most recently
from
September 11, 2026 14:18
4f65384 to
f8969d1
Compare
Bumps the npm_and_yarn group with 1 update in the /packages/profile-metrics-controller directory: [uuid](https://github.com/uuidjs/uuid). Updates `uuid` from 9.0.1 to 14.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v14.0.2) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/packages/profile-metrics-controller/npm_and_yarn-115a665413
branch
from
September 11, 2026 14:23
f8969d1 to
3414de4
Compare
4 tasks
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 14, 2026
…ask#10225) ## Explanation `expectConsistentDependenciesAndDevDependencies` requires every workspace to use the same version range for a dependency, but it reports through `dependency.error()`, which Yarn has no way to repair. So `yarn constraints --fix` does nothing for it and a human has to hand edit every manifest. That mostly hurts on Dependabot PRs. Dependabot's security updates walk manifests one at a time rather than treating the Yarn workspace as one project, so they routinely bump a dependency in some packages and not others. The result is a red build on a change nobody actually has to think about. PR MetaMask#10147 is a good example: it bumped `uuid` in 22 packages, `uuid` is declared in 24, and the two stragglers fail constraints. Same story on MetaMask#10157, MetaMask#10177 and MetaMask#9369, which is a large part of why `uuid` alone accounts for 25 of our open Dependabot alerts. This makes the rule fixable. When every conflicting range is plain semver, the one permitting the highest minimum version wins and `dependency.update()` aligns the rest, so `yarn constraints --fix` (which `yarn lint:fix` already runs) repairs a partial bump on its own. The previous docstring said it is impossible to compare NPM version ranges, so let the user decide. That is still true in general, and the fallback is unchanged: anything that is not a plain semver range, so aliases like `npm:foo@^1.0.0`, protocols like `workspace:^`, or dist tags, still produces the original "Pick one" error with the same wording. The narrower claim here is only that `semver.minVersion()` is comparable when every range has one, and `getHighestRange` bails out the moment one doesn't. Nothing else in the file changes. `ALLOWED_INCONSISTENT_DEPENDENCIES` and its filter behave exactly as before. ## Verification There is no test harness for `yarn.config.cjs`, so I verified against the monorepo itself: | Case | Result | | --- | --- | | Clean tree | exit 0, no manifests modified | | `uuid` bumped in one package only | `--fix` aligned all 25 manifests, re-check clean | | One range set to `npm:uuid@^14.0.2` | errors with "Pick one", modifies nothing | | One package downgraded to `^8.0.0` | pulled back up to `^9.0.1`, not propagated down | The last one is the safety property worth calling out: a wrong range in one manifest gets corrected upward rather than dragging every other package backwards. Worth knowing that `--fix` also reaches the root `package.json`, which declares some of these dependencies too. ## Trade off Aligning to the highest range is a real dependency change, not a formatting fix. One bump in one package can move the rest onto a new major, and `yarn lint:fix` will do that locally without asking. The argument for it is that the constraint already requires these to move together, so the only open question was who performs the alignment and in which direction, and aligning downward would mean reverting security fixes. ## References Part of [WPC-1161](https://consensyssoftware.atlassian.net/browse/WPC-1161). This is the first step toward dropping the `@metamask/*` allowlist in `.github/dependabot.yml` so we can bump everything, not just MetaMask packages. The follow up is a workflow on bot PRs that runs `yarn constraints --fix`, `yarn dedupe` and `yarn changelog:validate --checkDeps --fix`, modelled on the one snaps already has in `update-pull-request.yml`. Related to MetaMask#10147, MetaMask#10157, MetaMask#10177, MetaMask#9369. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate (no harness exists for `yarn.config.cjs`, see Verification above) - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) (no published package is touched) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them [WPC-1161]: https://consensyssoftware.atlassian.net/browse/WPC-1161?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /packages/profile-metrics-controller directory: uuid.
Updates
uuidfrom 9.0.1 to 14.0.2Release notes
Sourced from uuid's releases.
... (truncated)
Changelog
Sourced from uuid's changelog.
... (truncated)
Commits
fd59f02chore(main): release 14.0.2 (#967)f3c564edocs: point the Node support permalink at the CI version matrix (#974)b1da338fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)6adcc1dfix(v1): carry nsecs overflow into the timestamp's high bits (#972)ea83515docs: cleanup API summary (#968)ac36860chore: pinpublintversion in CI (#966)a67db57fix(v7): align default seq formula in v7Bytes with updateV7State (#965)7017780chore(main): release 14.0.1 (#964)f2c3e4bchore: fix release-please workflow (#963)27ffae5fix: add types condition to node export for moduleResolution bundler (#961)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.