@google-cloud/logging: archived dependency eventid-js pulls in vulnerable uuid@^8

[niksauer]

Library Name: @google-cloud/logging

Summary

@google-cloud/logging depends on eventid@^2.0.0, which depends on uuid@^8.0.0. The uuid package has a security advisory (GHSA-w5hq-g745-h8pq) affecting versions <= 10.1.0 — the fix requires uuid >= 11.1.1, which is outside eventid's ^8.0.0 range.

The upstream repo google/eventid-js is archived, so there will be no update to widen the uuid range.

Impact

Any project using @google-cloud/logging gets a Dependabot security alert for uuid that cannot be resolved without either:

• Removing the eventid dependency from @google-cloud/logging
• Inlining the eventid functionality (it's a small module)
• Forking eventid with an updated uuid range

Current state

• @google-cloud/logging@11.2.3 (latest) still depends on eventid@^2.0.0
• eventid@2.0.1 (last published 2022) depends on uuid@^8.0.0
• google/eventid-js is archived — no further releases expected
• The previous related issue was This module uses version 1.0.0 of eventid that still uses uuid 3.4.0 nodejs-logging#1143 (2021), which bumped eventid from 1.0 to 2.0

Suggestion

Consider dropping the eventid dependency and replacing it with an inline implementation or an alternative that doesn't depend on a vulnerable uuid version.

[niksauer]

The logging v11.2.3 release notes state "Remove vulnerable dependency uuid" (PR #8120), but uuid is still present in the dependency tree via eventid@^2.0.0 → uuid@^8.0.0:

https://github.com/googleapis/google-cloud-node/blob/main/handwritten/logging/package.json

PR #8120 replaced the library's direct usage of uuid with crypto.randomUUID, but didn't account for the transitive path through eventid. Projects using @google-cloud/logging@11.2.3 still get Dependabot alerts for uuid.

[arena-robot]

@niksauer - eventid dependency was removed from v11.2.3 - you can see it in https://github.com/googleapis/google-cloud-node/blob/main/handwritten/logging/package.json

No eventid dependency:

{
  "name": "@google-cloud/logging",
  "version": "11.2.3",
...
"dependencies": {
    "@google-cloud/common": "^5.0.0",
    "@google-cloud/paginator": "^5.0.0",
    "@google-cloud/projectify": "^4.0.0",
    "@google-cloud/promisify": "4.0.0",
    "@grpc/grpc-js": "^1.14.3",
    "@opentelemetry/api": "^1.7.0",
    "arrify": "^2.0.1",
    "dot-prop": "^6.0.0",
    "extend": "^3.0.2",
    "gcp-metadata": "^6.0.0",
    "google-auth-library": "^9.0.0",
    "google-gax": "^4.0.3",
    "long": "^5.3.2",
    "on-finished": "^2.3.0",
    "pumpify": "^2.0.1",
    "stream-events": "^1.0.5"
  },

However, it's still showing up in https://www.npmjs.com/package/@google-cloud/logging?activeTab=code

eventid dependency:

{
  "name": "@google-cloud/logging",
  "version": "11.2.3",
...
  "dependencies": {
    "@google-cloud/common": "^5.0.0",
    "@google-cloud/paginator": "^5.0.0",
    "@google-cloud/projectify": "^4.0.0",
    "@google-cloud/promisify": "4.0.0",
    "@grpc/grpc-js": "^1.14.3",
    "@opentelemetry/api": "^1.7.0",
    "arrify": "^2.0.1",
    "dot-prop": "^6.0.0",
    "eventid": "^2.0.0",
    "extend": "^3.0.2",
    "gcp-metadata": "^6.0.0",
    "google-auth-library": "^9.0.0",
    "google-gax": "^4.0.3",
    "long": "^5.3.2",
    "on-finished": "^2.3.0",
    "pumpify": "^2.0.1",
    "stream-events": "^1.0.5"
  },

I'm assuming we need to wait until v11.3.0 to see this reflected in the NPM, see PR #8687

[arena-robot]

v11.3.0 has been released with no eventid dependency

https://www.npmjs.com/package/@google-cloud/logging?activeTab=code