chore(deps): update dependency trailbase>uuid to v13.0.2 [security] by renovate[bot] · Pull Request #2245 · TanStack/db

renovate · 2026-10-25T02:33:55Z

Update TrailBase's UUID override to 13.0.2, which includes the buffer bounds security fix and restores provenance. Version 13.0.1 cannot pass the repository's no-downgrade trust policy. Preserve that policy and regenerate the matching lockfile.

Validation: frozen pnpm install with the existing trust policy; TrailBase adapter tests (149 passed) after building DB declarations. No production source or test expectations changed.

renovate · 2026-10-25T02:33:59Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 41 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
.                                        | [WARN] deprecated @svitejs/changesets-changelog-github-compact@1.2.0
.                                        | [WARN] deprecated eslint@9.39.4
packages/angular-db                      | [WARN] deprecated @angular/platform-browser-dynamic@20.3.16
packages/db                              | [WARN] deprecated @tanstack/config@0.22.2
Progress: resolved 140, reused 0, downloaded 0, added 0
Progress: resolved 351, reused 0, downloaded 0, added 0
/tmp/renovate/repos/github/TanStack/db/examples/react/todo:
[ERR_PNPM_TRUST_DOWNGRADE] High-risk trust downgrade for "uuid@13.0.1" (possible package takeover)

This error happened while installing the dependencies of trailbase@0.10.0

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had trusted publisher, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.
Progress: resolved 678, reused 0, downloaded 0, added 0

coderabbitai · 2026-10-25T02:34:04Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 40d59279-02ba-4b06-9d9c-7b7594668e5c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

changeset-bot · 2026-10-25T02:34:06Z

⚠️ No Changeset found

Latest commit: c2ea9bf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-10-28T17:46:16Z

More templates

@tanstack/angular-db

npm i https://pkg.pr.new/TanStack/db/@tanstack/angular-db@2245

@tanstack/browser-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/browser-db-sqlite-persistence@2245

@tanstack/capacitor-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/capacitor-db-sqlite-persistence@2245

@tanstack/cloudflare-durable-objects-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/cloudflare-durable-objects-db-sqlite-persistence@2245

@tanstack/convex-db-collection

npm i https://pkg.pr.new/TanStack/db/@tanstack/convex-db-collection@2245

@tanstack/db

npm i https://pkg.pr.new/TanStack/db/@tanstack/db@2245

@tanstack/db-ivm

npm i https://pkg.pr.new/TanStack/db/@tanstack/db-ivm@2245

@tanstack/db-sqlite-persistence-core

npm i https://pkg.pr.new/TanStack/db/@tanstack/db-sqlite-persistence-core@2245

@tanstack/electric-db-collection

npm i https://pkg.pr.new/TanStack/db/@tanstack/electric-db-collection@2245

@tanstack/electron-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/electron-db-sqlite-persistence@2245

@tanstack/expo-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/expo-db-sqlite-persistence@2245

@tanstack/node-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/node-db-sqlite-persistence@2245

@tanstack/offline-transactions

npm i https://pkg.pr.new/TanStack/db/@tanstack/offline-transactions@2245

@tanstack/powersync-db-collection

npm i https://pkg.pr.new/TanStack/db/@tanstack/powersync-db-collection@2245

@tanstack/preact-db

npm i https://pkg.pr.new/TanStack/db/@tanstack/preact-db@2245

@tanstack/query-db-collection

npm i https://pkg.pr.new/TanStack/db/@tanstack/query-db-collection@2245

@tanstack/react-db

npm i https://pkg.pr.new/TanStack/db/@tanstack/react-db@2245

@tanstack/react-native-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/react-native-db-sqlite-persistence@2245

@tanstack/react-router-with-db

npm i https://pkg.pr.new/TanStack/db/@tanstack/react-router-with-db@2245

@tanstack/rxdb-db-collection

npm i https://pkg.pr.new/TanStack/db/@tanstack/rxdb-db-collection@2245

@tanstack/solid-db

npm i https://pkg.pr.new/TanStack/db/@tanstack/solid-db@2245

@tanstack/svelte-db

npm i https://pkg.pr.new/TanStack/db/@tanstack/svelte-db@2245

@tanstack/tauri-db-sqlite-persistence

npm i https://pkg.pr.new/TanStack/db/@tanstack/tauri-db-sqlite-persistence@2245

@tanstack/trailbase-db-collection

npm i https://pkg.pr.new/TanStack/db/@tanstack/trailbase-db-collection@2245

@tanstack/vue-db

npm i https://pkg.pr.new/TanStack/db/@tanstack/vue-db@2245

commit: c2ea9bf

github-actions · 2026-10-28T17:53:30Z

Size Change: 0 B

Total Size: 237 kB

ℹ️ View Unchanged

Filename	Size
`packages/db/dist/esm/client.js`	5.39 kB
`packages/db/dist/esm/collection-options-brand.js`	219 B
`packages/db/dist/esm/collection-options.js`	258 B
`packages/db/dist/esm/collection/change-events.js`	1.76 kB
`packages/db/dist/esm/collection/changes.js`	3.06 kB
`packages/db/dist/esm/collection/cleanup-queue.js`	828 B
`packages/db/dist/esm/collection/config-errors.js`	547 B
`packages/db/dist/esm/collection/events.js`	504 B
`packages/db/dist/esm/collection/health-tree.js`	698 B
`packages/db/dist/esm/collection/index.js`	6.32 kB
`packages/db/dist/esm/collection/indexes.js`	2.3 kB
`packages/db/dist/esm/collection/lifecycle.js`	5.59 kB
`packages/db/dist/esm/collection/mutations.js`	2.95 kB
`packages/db/dist/esm/collection/state.js`	7.69 kB
`packages/db/dist/esm/collection/subscription.js`	9.54 kB
`packages/db/dist/esm/collection/sync.js`	6.51 kB
`packages/db/dist/esm/collection/validate-config.js`	1.17 kB
`packages/db/dist/esm/deferred.js`	207 B
`packages/db/dist/esm/error-message.js`	642 B
`packages/db/dist/esm/errors.js`	7.27 kB
`packages/db/dist/esm/event-emitter.js`	1.06 kB
`packages/db/dist/esm/index.js`	4.79 kB
`packages/db/dist/esm/indexed-db-wrapper.js`	1.91 kB
`packages/db/dist/esm/indexed-db.js`	3.81 kB
`packages/db/dist/esm/indexes/auto-index.js`	924 B
`packages/db/dist/esm/indexes/base-index.js`	1.92 kB
`packages/db/dist/esm/indexes/basic-index.js`	1.93 kB
`packages/db/dist/esm/indexes/btree-index.js`	1.62 kB
`packages/db/dist/esm/indexes/index-registry.js`	916 B
`packages/db/dist/esm/indexes/reverse-index.js`	1.01 kB
`packages/db/dist/esm/live-query-adapter.js`	845 B
`packages/db/dist/esm/live-query-observer-client.js`	2.17 kB
`packages/db/dist/esm/live-query-observer.js`	3.3 kB
`packages/db/dist/esm/live-query-options.js`	2.02 kB
`packages/db/dist/esm/live-query-primitives.js`	406 B
`packages/db/dist/esm/live-query-window-binding.js`	1.56 kB
`packages/db/dist/esm/live-query-window-controller.js`	4.02 kB
`packages/db/dist/esm/local-only.js`	1.02 kB
`packages/db/dist/esm/local-storage.js`	4.58 kB
`packages/db/dist/esm/optimistic-action.js`	359 B
`packages/db/dist/esm/paced-mutations.js`	1.11 kB
`packages/db/dist/esm/proxy.js`	3.51 kB
`packages/db/dist/esm/query/builder/clone-query.js`	854 B
`packages/db/dist/esm/query/builder/functions.js`	1.61 kB
`packages/db/dist/esm/query/builder/group-keys.js`	157 B
`packages/db/dist/esm/query/builder/include-functions.js`	229 B
`packages/db/dist/esm/query/builder/index.js`	7.72 kB
`packages/db/dist/esm/query/builder/query-ir.js`	312 B
`packages/db/dist/esm/query/builder/ref-proxy-identity.js`	292 B
`packages/db/dist/esm/query/builder/ref-proxy.js`	1.67 kB
`packages/db/dist/esm/query/builder/wrapper-identity.js`	221 B
`packages/db/dist/esm/query/compiler/evaluators.js`	2.51 kB
`packages/db/dist/esm/query/compiler/expressions.js`	603 B
`packages/db/dist/esm/query/compiler/find-aggregate.js`	328 B
`packages/db/dist/esm/query/compiler/group-by.js`	4.42 kB
`packages/db/dist/esm/query/compiler/grouping.js`	161 B
`packages/db/dist/esm/query/compiler/index.js`	10.4 kB
`packages/db/dist/esm/query/compiler/joins.js`	3.42 kB
`packages/db/dist/esm/query/compiler/lazy-targets.js`	1.11 kB
`packages/db/dist/esm/query/compiler/order-by.js`	2.8 kB
`packages/db/dist/esm/query/compiler/parent-routes.js`	319 B
`packages/db/dist/esm/query/compiler/query-equivalence.js`	568 B
`packages/db/dist/esm/query/compiler/route-metadata.js`	1.24 kB
`packages/db/dist/esm/query/compiler/select.js`	1.5 kB
`packages/db/dist/esm/query/effect.js`	5.79 kB
`packages/db/dist/esm/query/equality-conjunct.js`	486 B
`packages/db/dist/esm/query/equality-value-identity.js`	736 B
`packages/db/dist/esm/query/expression-helpers.js`	1.61 kB
`packages/db/dist/esm/query/ir-stable-identity.js`	4.29 kB
`packages/db/dist/esm/query/ir.js`	2.26 kB
`packages/db/dist/esm/query/join-conditions.js`	257 B
`packages/db/dist/esm/query/live-query-collection.js`	391 B
`packages/db/dist/esm/query/live/bucket-facade-adapter.js`	3.17 kB
`packages/db/dist/esm/query/live/collection-config-builder.js`	8.24 kB
`packages/db/dist/esm/query/live/collection-registry.js`	264 B
`packages/db/dist/esm/query/live/collection-subscriber.js`	2.64 kB
`packages/db/dist/esm/query/live/graph-scheduler.js`	305 B
`packages/db/dist/esm/query/live/includes-runtime.js`	212 B
`packages/db/dist/esm/query/live/internal.js`	145 B
`packages/db/dist/esm/query/live/materialized-pipeline.js`	1.94 kB
`packages/db/dist/esm/query/live/ordered-source-loader.js`	6.47 kB
`packages/db/dist/esm/query/live/public-key-reduction.js`	970 B
`packages/db/dist/esm/query/live/subset-demand-controller.js`	2.44 kB
`packages/db/dist/esm/query/live/utils.js`	1.35 kB
`packages/db/dist/esm/query/optimizer.js`	2.95 kB
`packages/db/dist/esm/query/pooled-live-query.js`	5.14 kB
`packages/db/dist/esm/query/pooled-source.js`	219 B
`packages/db/dist/esm/query/query-once.js`	359 B
`packages/db/dist/esm/query/runtime-reference-identity.js`	630 B
`packages/db/dist/esm/query/subset-dedupe.js`	493 B
`packages/db/dist/esm/scheduler.js`	1.23 kB
`packages/db/dist/esm/SortedMap.js`	1.77 kB
`packages/db/dist/esm/strategies/commit-completion.js`	156 B
`packages/db/dist/esm/strategies/debounceStrategy.js`	658 B
`packages/db/dist/esm/strategies/queueStrategy.js`	523 B
`packages/db/dist/esm/strategies/serial-pacer.js`	486 B
`packages/db/dist/esm/strategies/throttleStrategy.js`	738 B
`packages/db/dist/esm/sync-persistence.js`	626 B
`packages/db/dist/esm/sync-receipt.js`	211 B
`packages/db/dist/esm/transaction-commit-work.js`	351 B
`packages/db/dist/esm/transactions.js`	4.57 kB
`packages/db/dist/esm/utils.js`	1.77 kB
`packages/db/dist/esm/utils/array-utils.js`	270 B
`packages/db/dist/esm/utils/browser-polyfills.js`	304 B
`packages/db/dist/esm/utils/btree.js`	3.02 kB
`packages/db/dist/esm/utils/callbacks.js`	219 B
`packages/db/dist/esm/utils/comparison.js`	1.95 kB
`packages/db/dist/esm/utils/cursor.js`	753 B
`packages/db/dist/esm/utils/error.js`	262 B
`packages/db/dist/esm/utils/get-or-create.js`	155 B
`packages/db/dist/esm/utils/index-optimization.js`	2.58 kB
`packages/db/dist/esm/utils/source-record.js`	140 B
`packages/db/dist/esm/utils/type-guards.js`	230 B
`packages/db/dist/esm/utils/uuid.js`	530 B
`packages/db/dist/esm/virtual-props.js`	413 B
`packages/react-db/dist/esm/DbProvider.js`	317 B
`packages/react-db/dist/esm/development.js`	190 B
`packages/react-db/dist/esm/HydrationBoundary.js`	263 B
`packages/react-db/dist/esm/index.js`	330 B
`packages/react-db/dist/esm/live-query-internals.js`	282 B
`packages/react-db/dist/esm/source-id-bindings.js`	339 B
`packages/react-db/dist/esm/useLiveInfiniteQuery.js`	1.52 kB
`packages/react-db/dist/esm/useLiveQuery.js`	3.41 kB
`packages/react-db/dist/esm/useLiveQueryEffect.js`	504 B
`packages/react-db/dist/esm/useLiveSuspenseQuery.js`	1.37 kB
`packages/react-db/dist/esm/usePacedMutations.js`	429 B

_{compressed-size-action::db-and-react-package-size}

renovate Bot added the dependencies label Oct 25, 2026

chore(deps): update dependency trailbase>uuid to v13.0.1 [security]

486f3b2

renovate Bot force-pushed the renovate/npm-trailbase-uuid-vulnerability branch from 265ef86 to 486f3b2 Compare October 25, 2026 05:22

chore(deps): use the trusted UUID 13.0.2 security patch

c2ea9bf

KyleAMathews changed the title ~~chore(deps): update dependency trailbase>uuid to v13.0.1 [security]~~ chore(deps): update dependency trailbase>uuid to v13.0.2 [security] Oct 28, 2026

KyleAMathews merged commit 88d912b into main Oct 28, 2026
25 checks passed

KyleAMathews deleted the renovate/npm-trailbase-uuid-vulnerability branch October 28, 2026 17:58

Navigation Menu

Repository navigation

chore(deps): update dependency trailbase>uuid to v13.0.2 [security] - #2245

chore(deps): update dependency trailbase>uuid to v13.0.2 [security]#2245
KyleAMathews merged 2 commits into
mainfrom
renovate/npm-trailbase-uuid-vulnerability

renovate Bot commented Oct 25, 2026 •

edited by KyleAMathews

Loading

Uh oh!

renovate Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

Review skipped

Uh oh!

changeset-bot Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 28, 2026

Uh oh!

github-actions Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 25, 2026 • edited by KyleAMathews Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

coderabbitai Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

changeset-bot Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

pkg-pr-new Bot commented Oct 28, 2026

Uh oh!

github-actions Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Oct 25, 2026 •

edited by KyleAMathews

Loading

renovate Bot commented Oct 25, 2026 •

edited

Loading

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

changeset-bot Bot commented Oct 25, 2026 •

edited

Loading