Please bump uuid to version ^14

[LongBu]

Hi there,
Can you please bump up the uuid version to ^14 in tentatively version 0.3.25. This should work without issue per reviewing the code. Please see the following for further details: https://mend.io/vulnerability-database/CVE-2026-41907/
Thank you for your time!

[auvipy]

Im open to a contribution here

[PabloEnricoEnrico]

Adding some context from our investigation:

The vulnerability GHSA-w5hq-g745-h8pq (CVE-2026-41907) affects uuid versions < 14.0.0 - the fix is only in v14+. Bumping to ^9.0.0 or ^13.0.0 would not resolve it.

sockjs uses uuid in exactly one place - lib/transport.js:

uuidv4 = require('uuid').v4;
// ...
this.id = uuidv4();

Two possible paths forward:

1. Bump to uuid@^14.0.0 - Note that uuid dropped CommonJS support in v12.0.0, so the require('uuid').v4 pattern would need to change to a dynamic import() or the package would need to be converted to ESM. Additionally, v14 requires Node 20+.
2. Drop the uuid dependency entirely - Replace uuid.v4() with Node's built-in crypto.randomUUID() (available since Node 14.17+, 15.6+). This produces an identical v4 UUID string, eliminates the dependency, and avoids the ESM migration entirely.

Option 2 seems preferable - it's a one-line change, removes a dependency, and works with all currently supported Node.js versions.

[JackCoplandGranta]

Resolved by #315 (though a new release has not yet been pushed at time of writing)

[G-Rath]

@auvipy it looks like this codebase is getting some love which is great, but wondering if we could get a new release focused on #315 before bigger changes like converting to ESM are landed, to make it easier for people to update to address the UUID vulnerability

[PabloEnricoEnrico]

Is there a maintainer who can publish a new release to npm?

[rafael-nogueras]

@PabloEnricoEnrico As I understand it, @auvipy is the new maintainer.

[PabloEnricoEnrico]

@auvipy It's been ~7 weeks since this was merged and several people have already asked about a release with no response. I'd like to understand what's blocking the publish so the community can help move this forward.

A few questions:

1. Is there something blocking the npm release? CI issues, missing permissions, wanting to batch more changes, Node version policy decisions — whatever it is, it'd be useful to know.
2. Is there a roadmap for the next release? The main branch also has breaking changes (uuid removal, the version bump to 0.4.0-rc.1 in package.json) — is the plan to release this as a patch on 0.3.x or as 0.4.0?
3. Do you need help? If this is a bandwidth/permissions issue, there are many people watching this repo right now who would be happy to contribute PRs for release prep (changelog, version bump, CI checks) or help in whatever way is useful. Explaining the current situation and what's needed would go a long way.

Context on why this matters: sockjs@0.3.24 is a transitive dependency for a significant portion of the npm ecosystem. It pulls in uuid@^8.3.2, which scanners flag as vulnerable (GHSA-w5hq-g745-h8pq). The workaround is overriding to uuid@11.1.1 (the only patched version that's still CJS-compatible), but many teams can't or won't do manual overrides, and some are being blocked by security gates in their CI pipelines.

The fix is literally already here in main — it just needs to reach npm.

cc @brycekahle @majek — tagging you as you're listed as contributors/collaborators in package.json and likely have npm publish permissions.

[EinfachHans]

Looking forward to a new release with this fix!

[LucasReinaldo]

hey @auvipy, @squaremo, @majek, and @mrjoes, could any of you folks take a look here, please?

[bmrobson101]

Can we get a timeframe at least on when we could expect a new release?

[Yin117]

At this rate it might be becoming time to fork the repo.