@google-cloud/logging: archived dependency eventid-js pulls in vulnerable uuid@^8

[niksauer]

Library Name: @google-cloud/logging

Summary

@google-cloud/logging depends on eventid@^2.0.0, which depends on uuid@^8.0.0. The uuid package has a security advisory (GHSA-w5hq-g745-h8pq) affecting versions <= 10.1.0 — the fix requires uuid >= 11.1.1, which is outside eventid's ^8.0.0 range.

The upstream repo google/eventid-js is archived, so there will be no update to widen the uuid range.

Impact

Any project using @google-cloud/logging gets a Dependabot security alert for uuid that cannot be resolved without either:

• Removing the eventid dependency from @google-cloud/logging
• Inlining the eventid functionality (it's a small module)
• Forking eventid with an updated uuid range

Current state

• @google-cloud/logging@11.2.3 (latest) still depends on eventid@^2.0.0
• eventid@2.0.1 (last published 2022) depends on uuid@^8.0.0
• google/eventid-js is archived — no further releases expected
• The previous related issue was This module uses version 1.0.0 of eventid that still uses uuid 3.4.0 nodejs-logging#1143 (2021), which bumped eventid from 1.0 to 2.0

Suggestion

Consider dropping the eventid dependency and replacing it with an inline implementation or an alternative that doesn't depend on a vulnerable uuid version.

[niksauer]

The logging v11.2.3 release notes state "Remove vulnerable dependency uuid" (PR #8120), but uuid is still present in the dependency tree via eventid@^2.0.0 → uuid@^8.0.0:

https://github.com/googleapis/google-cloud-node/blob/main/handwritten/logging/package.json

PR #8120 replaced the library's direct usage of uuid with crypto.randomUUID, but didn't account for the transitive path through eventid. Projects using @google-cloud/logging@11.2.3 still get Dependabot alerts for uuid.