Skip to content

Fix Dependabot failure: override uuid to ^14.0.1 - #1886

Merged
stephenegriffin merged 3 commits into
mainfrom
copilot/fix-dependabot-failure
Jul 24, 2026
Merged

Fix Dependabot failure: override uuid to ^14.0.1#1886
stephenegriffin merged 3 commits into
mainfrom
copilot/fix-dependabot-failure

Conversation

Copilot AI commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Dependabot's security update job was failing with security_update_not_possible for uuid because conflicting transitive constraints made it impossible to resolve >=14.0.0 (the minimum non-vulnerable version):

  • @microsoft/teamsfx-core@3.0.13@microsoft/kiota@1.31.1 requires uuid@^13.0.0
  • @microsoft/teamsfx-core@3.0.13office-addin-usage-data@1.6.14 requires uuid@8.3.2

Both are pulled in as peer deps via office-addin-dev-settings@microsoft/m365agentstoolkit-cli.

Changes

  • package.json: Add uuid to npm overrides alongside the existing tmp override:
    "overrides": {
      "tmp": "^0.2.5",
      "uuid": "^14.0.1"
    }
  • package-lock.json: Regenerated — three conflicting uuid instances (8.3.2, 13.0.2, and a nested 14.0.1) collapsed to a single uuid@14.0.1.

The override is safe: @microsoft/kiota@1.34.1 already upgraded its own uuid peer dep to ^14.0.1, confirming the API is compatible across the version bump.

…ility

The Dependabot job was failing with `security_update_not_possible` because
transitive dependencies had conflicting uuid version requirements:
- @microsoft/kiota@1.31.1 (via teamsfx-core) requires uuid@^13.0.0
- office-addin-usage-data@1.6.14 (via teamsfx-core) requires uuid@8.3.2
- Both are vulnerable; minimum non-vulnerable version is uuid@14.0.0

Adding uuid to npm overrides forces ^14.0.1 throughout the dependency tree,
consolidating from three vulnerable instances to a single uuid@14.0.1.
This is safe since @microsoft/kiota@1.34.1 already upgraded to uuid@^14.0.1.
Copilot AI changed the title [WIP] Fix failing GitHub Actions job 'Dependabot' Fix Dependabot failure: override uuid to ^14.0.1 Jul 24, 2026
Copilot AI requested a review from stephenegriffin July 24, 2026 15:10
@stephenegriffin
stephenegriffin marked this pull request as ready for review July 24, 2026 15:15
@stephenegriffin
stephenegriffin enabled auto-merge (squash) July 24, 2026 15:15
@stephenegriffin

Copy link
Copy Markdown
Member

@copilot resolve the merge conflicts in this pull request

Copilot AI commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

@copilot resolve the merge conflicts in this pull request

Resolved in 42e8382. The conflict was in the overrides section of package.jsonmain had added @babel/core, js-yaml, and @hono/node-server overrides while this branch added uuid. All entries are now merged together.

@stephenegriffin
stephenegriffin merged commit 2b4393b into main Jul 24, 2026
7 checks passed
@stephenegriffin
stephenegriffin deleted the copilot/fix-dependabot-failure branch July 24, 2026 19:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants