Skip to content

fix: update uuid to v11, drop closure-compiler (keep Node 18 support)#1481

Merged
Matus Tomlein (matus-tomlein) merged 4 commits into
release/4.8.3from
fix/update-uuid-v11
Jun 30, 2026
Merged

fix: update uuid to v11, drop closure-compiler (keep Node 18 support)#1481
Matus Tomlein (matus-tomlein) merged 4 commits into
release/4.8.3from
fix/update-uuid-v11

Conversation

@matus-tomlein

@matus-tomlein Matus Tomlein (matus-tomlein) commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Alternative to #1480 that keeps Node 18 / CommonJS consumer support by pinning uuid to v11 instead of v14.

uuid v12+ is ESM-only (CommonJS support was dropped in v12). Since @snowplow/tracker-core / @snowplow/node-tracker ship CommonJS builds that require('uuid'), jumping to v14 would break downstream CJS consumers on Node < 20.19. uuid v11 still ships both CJS and ESM builds, so it's the last line that preserves that support — and it is not yet deprecated (the deprecation notice itself recommends v11 for CommonJS codebases).

The code uses only the v4 named import, which is unchanged across these versions.

Fixes #1471.

Changes

  • uuid ^10.0.0 → ^11.0.0 in the 7 packages that use it (tracker-core, browser-tracker-core, react-native-tracker, and the media, media-tracking, youtube-tracking, screen-tracking plugins).
  • Removed the redundant @types/uuid devDependency (uuid v11 bundles its own types).
  • Dropped @ampproject/rollup-plugin-closure-compiler from all 33 rollup configs and their package.json devDependencies. This is required, not optional: uuid v11 emits modern syntax (?? / ?.) that closure-compiler's bundled acorn-walk@7.1.1 cannot parse — the build fails at the closure step otherwise. 31 configs already chained compiler(), terser() → now just terser(); browser-tracker (closure was its only minifier) was swapped to terser() (already an available devDependency).
  • Updated the uuid.v4 jest spies in 3 browser-tracker-core test files to satisfy v11's overloaded type signature (v4 now also has a Uint8Array-returning overload).
  • Regenerated the lockfile and added Rush change files.

Validation

  • ✅ rush build succeeds for every package (only the pre-existing browserslist warning remains).
  • ✅ Tests pass for all affected packages: tracker-core (130), browser-tracker-core (162), react-native-tracker (68), media (67), media-tracking (38), screen-tracking (9), youtube-tracking (15).
  • ✅ rush change --verify passes.

Size trade-off

Dropping closure-compiler costs ~2–3% gzipped per bundle (≤0.8 KB on sp.js); terser retains ~97–98% of the minification benefit. Same trade-off as #1480.

🤖 Generated with Claude Code

@matus-tomlein @claude
fix: update uuid to v11 and drop closure-compiler
f7d9b65 
Bumps `uuid` from `^10.0.0` to `^11.0.0` in the 7 packages that use it
(tracker-core, browser-tracker-core, react-native-tracker, and the media,
media-tracking, youtube-tracking and screen-tracking plugins). The code
uses only the `v4` named import, which is unchanged. uuid v11 still ships
both CommonJS and ESM builds, preserving Node 18 / CJS consumer support
(unlike v12+, which is ESM-only).

uuid v11 emits modern syntax (`??` / `?.`) that closure-compiler's bundled
`acorn-walk@7.1.1` cannot parse, so closure-compiler is removed from all 33
rollup configs and their package.json devDependencies. 31 configs already
chained `compiler(), terser()` and now just use `terser()`; browser-tracker
relied on closure as its only minifier, so it now uses `terser()` (already
available as a devDependency).

Removes the redundant `@types/uuid` devDependency (uuid v11 bundles its own
types) and updates the `uuid.v4` jest spies in browser-tracker-core tests to
satisfy v11's overloaded type signature.

Fixes #1471.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@matus-tomlein @claude
chore: add rush change files for uuid v11 update
63a818c 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings June 24, 2026 08:40
@wiz-2cefcfbd9e

wiz-2cefcfbd9e Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Wiz Scan Summary

Scanner Findings
Vulnerability Finding Vulnerabilities -
Data Finding Sensitive Data -
Secret Finding Secrets -
IaC Misconfiguration IaC Misconfigurations -
SAST Finding SAST Findings 1 Info
Software Management Finding Software Management Findings -
Total 1 Info

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

Copilot AI reviewed Jun 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the monorepo to use uuid v11 (instead of newer ESM-only majors) to preserve CommonJS consumer compatibility (including Node 18), and removes the unmaintained Closure Compiler Rollup step that breaks on modern dependency syntax.

Changes:

  • Bump uuid from ^10.0.0 to ^11.0.0 in the affected packages and remove @types/uuid where redundant.
  • Remove @ampproject/rollup-plugin-closure-compiler from Rollup configs and package devDependencies; rely on terser() for minification.
  • Adjust Jest spies in browser-tracker-core tests to satisfy uuid v11 typing.

Reviewed changes

Copilot reviewed 105 out of 106 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
trackers/react-native-tracker/package.json Bumps uuid to v11 and removes @types/uuid.
trackers/javascript-tracker/rollup.config.js Removes Closure Compiler from build pipeline.
trackers/javascript-tracker/package.json Drops Closure Compiler devDependency.
trackers/browser-tracker/rollup.config.js Replaces Closure Compiler minification with terser().
trackers/browser-tracker/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-youtube-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-youtube-tracking/package.json Bumps uuid to v11; drops Closure Compiler and @types/uuid.
plugins/browser-plugin-webview/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-webview/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-web-vitals/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-web-vitals/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-vimeo-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-vimeo-tracking/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-timezone/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-timezone/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-snowplow-ecommerce/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-snowplow-ecommerce/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-site-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-site-tracking/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-screen-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-screen-tracking/package.json Bumps uuid to v11; drops Closure Compiler and @types/uuid.
plugins/browser-plugin-privacy-sandbox/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-privacy-sandbox/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-performance-timing/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-performance-timing/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-performance-navigation-timing/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-performance-navigation-timing/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-optimizely-x/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-optimizely-x/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-media/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-media/package.json Bumps uuid to v11; drops Closure Compiler and @types/uuid.
plugins/browser-plugin-media-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-media-tracking/package.json Bumps uuid to v11; drops Closure Compiler and @types/uuid.
plugins/browser-plugin-link-click-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-link-click-tracking/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-geolocation/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-geolocation/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-ga-cookies/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-ga-cookies/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-form-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-form-tracking/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-focalmeter/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-focalmeter/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-event-specifications/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-event-specifications/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-error-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-error-tracking/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-enhanced-ecommerce/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-enhanced-ecommerce/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-enhanced-consent/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-enhanced-consent/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-element-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-element-tracking/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-debugger/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-debugger/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-client-hints/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-client-hints/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-button-click-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-button-click-tracking/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-bot-detection/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-bot-detection/package.json Drops Closure Compiler devDependency.
plugins/browser-plugin-ad-tracking/rollup.config.js Removes Closure Compiler from minification pipeline.
plugins/browser-plugin-ad-tracking/package.json Drops Closure Compiler devDependency.
libraries/tracker-core/rollup.config.js Removes Closure Compiler from minification pipeline.
libraries/tracker-core/package.json Bumps uuid to v11; drops Closure Compiler and @types/uuid.
libraries/browser-tracker-core/test/tracker/session_data.test.ts Updates Jest spy typing for uuid.v4 overloads.
libraries/browser-tracker-core/test/tracker/cross_domain.test.ts Updates Jest spy typing for uuid.v4 overloads.
libraries/browser-tracker-core/test/id_cookie.test.ts Updates Jest spy typing for uuid.v4 overloads.
libraries/browser-tracker-core/rollup.config.js Removes Closure Compiler from minification pipeline.
libraries/browser-tracker-core/package.json Bumps uuid to v11; drops Closure Compiler and @types/uuid.
common/config/rush/repo-state.json Updates Rush repo state hash after lockfile regen.
common/config/rush/pnpm-lock.yaml Regenerates lockfile for uuid v11 and removed Closure Compiler deps.
common/changes/@snowplow/tracker-core/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/react-native-tracker/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/javascript-tracker/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-tracker/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-tracker-core/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-youtube-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-webview/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-web-vitals/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-vimeo-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-timezone/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-snowplow-ecommerce/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-site-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-screen-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-privacy-sandbox/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-performance-timing/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-performance-navigation-timing/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-optimizely-x/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-media/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-media-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-link-click-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-geolocation/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-ga-cookies/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-form-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-focalmeter/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-event-specifications/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-error-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-enhanced-ecommerce/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-enhanced-consent/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-element-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-debugger/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-client-hints/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-button-click-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-bot-detection/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
common/changes/@snowplow/browser-plugin-ad-tracking/fix-update-uuid-v11_2026-06-24-08-39.json Rush change file for release notes/versioning.
Files not reviewed (1)
  • common/config/rush/pnpm-lock.yaml: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread libraries/tracker-core/rollup.config.js
Comment thread plugins/browser-plugin-media/rollup.config.js
Comment thread plugins/browser-plugin-media-tracking/rollup.config.js
Comment thread plugins/browser-plugin-youtube-tracking/rollup.config.js
Comment thread plugins/browser-plugin-screen-tracking/rollup.config.js
Comment thread libraries/browser-tracker-core/rollup.config.js
@matus-tomlein @claude
chore: remove personal email from rush change files
fbec4b5 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@vlinder

vlinder commented Jun 24, 2026

Copy link
Copy Markdown

It could make sense to "force" a later v11, ^11.1.1, that has the vulnerabilities patched.

@matus-tomlein @claude
fix: bump uuid floor to ^11.1.1 for GHSA-w5hq-g745-h8pq
9f161ab 
uuid < 11.1.1 has a moderate-severity missing buffer bounds check in
v3/v5/v6 when a buffer is provided (GHSA-w5hq-g745-h8pq). The tracker
only uses v4 with no buffer, so it is not exposed, but raising the
declared floor to ^11.1.1 keeps audit tooling and downstream consumers
on the patched release. The lockfile already resolved to 11.1.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@matus-tomlein Matus Tomlein (matus-tomlein) changed the base branch from master to release/4.8.3 June 30, 2026 07:27
@matus-tomlein Matus Tomlein (matus-tomlein) merged commit ae4eb88 into release/4.8.3 Jun 30, 2026
7 checks passed
@matus-tomlein Matus Tomlein (matus-tomlein) deleted the fix/update-uuid-v11 branch June 30, 2026 13:48
Matus Tomlein (matus-tomlein) added a commit that referenced this pull request Jun 30, 2026
@matus-tomlein
fix: update uuid to v11, drop closure-compiler (keep Node 18 support) (…
dd2e92b 
…#1481)

## Summary

Alternative to #1480 that keeps **Node 18 / CommonJS consumer support** by pinning `uuid` to **v11** instead of v14.

`uuid` v12+ is **ESM-only** (CommonJS support was dropped in v12). Since `@snowplow/tracker-core` / `@snowplow/node-tracker` ship CommonJS builds that `require('uuid')`, jumping to v14 would break downstream CJS consumers on Node < 20.19. **uuid v11 still ships both CJS and ESM builds**, so it's the last line that preserves that support — and it is not yet deprecated (the deprecation notice itself recommends v11 for CommonJS codebases).

The code uses only the `v4` named import, which is unchanged across these versions.

Fixes #1471.

## Changes

- **`uuid` `^10.0.0` → `^11.0.0`** in the 7 packages that use it (`tracker-core`, `browser-tracker-core`, `react-native-tracker`, and the `media`, `media-tracking`, `youtube-tracking`, `screen-tracking` plugins).
- **Removed the redundant `@types/uuid`** devDependency (uuid v11 bundles its own types).
- **Dropped `@ampproject/rollup-plugin-closure-compiler`** from all 33 rollup configs and their `package.json` devDependencies. This is **required**, not optional: uuid v11 emits modern syntax (`??` / `?.`) that closure-compiler's bundled `acorn-walk@7.1.1` cannot parse — the build fails at the closure step otherwise. 31 configs already chained `compiler(), terser()` → now just `terser()`; `browser-tracker` (closure was its only minifier) was swapped to `terser()` (already an available devDependency).
- **Updated the `uuid.v4` jest spies** in 3 `browser-tracker-core` test files to satisfy v11's overloaded type signature (`v4` now also has a `Uint8Array`-returning overload).
- Regenerated the lockfile and added Rush change files.

## Validation

- ✅ `rush build` succeeds for every package (only the pre-existing browserslist warning remains).
- ✅ Tests pass for all affected packages: `tracker-core` (130), `browser-tracker-core` (162), `react-native-tracker` (68), `media` (67), `media-tracking` (38), `screen-tracking` (9), `youtube-tracking` (15).
- ✅ `rush change --verify` passes.

## Size trade-off

Dropping closure-compiler costs ~2–3% gzipped per bundle (≤0.8 KB on `sp.js`); terser retains ~97–98% of the minification benefit. Same trade-off as #1480.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@igneel64 Peter Perlepes (igneel64) igneel64 approved these changes
@greg-el Greg Leonard (greg-el) Awaiting requested review from greg-el
+1 more reviewer
@vlinder vlinder vlinder approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Upgrade uuid to v14, and v10 is deprecated

4 participants

@matus-tomlein @vlinder @igneel64