# What changed in uuid

> 8 changes in uuid 13 to 14 from its official release notes, upgrade guides and advisories: 2 breaking, 2 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/uuid/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## uuid 14

### Breaking changes

- The package expects crypto to be global everywhere, requiring Node.js 20 or later. (14.0.0) — [release notes](https://github.com/uuidjs/uuid/releases/tag/v14.0.0)
- Node.js 18 support was dropped. (14.0.0) — [release notes](https://github.com/uuidjs/uuid/releases/tag/v14.0.0)

### Fixes and other changes

- Carries nsecs overflow into the timestamp's high bits. (14.0.2) — [release notes](https://github.com/uuidjs/uuid/releases/tag/v14.0.2)
- Sets the multicast bit on v1Bytes's own randomly-generated node. (14.0.2) — [release notes](https://github.com/uuidjs/uuid/releases/tag/v14.0.2)
- Aligns the default seq formula in v7Bytes with updateV7State. (14.0.2) — [release notes](https://github.com/uuidjs/uuid/releases/tag/v14.0.2)
- Adds a types condition to the Node export so TypeScript can resolve the package with moduleResolution bundler. (14.0.1) — [release notes](https://github.com/uuidjs/uuid/releases/tag/v14.0.1)

## uuid 13

### Security

- Backports a fix for GHSA-w5hq-g745-h8pq. (11.1.1, 12.0.1, 13.0.1) — [release notes](https://github.com/uuidjs/uuid/releases/tag/v12.0.1), [release notes](https://github.com/uuidjs/uuid/releases/tag/v11.1.1), [release notes](https://github.com/uuidjs/uuid/releases/tag/v13.0.1), [security advisory](https://github.com/advisories/GHSA-W5HQ-G745-H8PQ)
- uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided (11.1.1, 12.0.1, 13.0.1) — [security advisory](https://github.com/advisories/GHSA-W5HQ-G745-H8PQ)