Skip to content

fix(uuid): reject timestamps that exceed 48 bits in v7.generate() - #7284

Open
tomas-zijdemans wants to merge 1 commit into
denoland:mainfrom
tomas-zijdemans:fix-uuid-v7-48bit-timestamp
Open

fix(uuid): reject timestamps that exceed 48 bits in v7.generate()#7284
tomas-zijdemans wants to merge 1 commit into
denoland:mainfrom
tomas-zijdemans:fix-uuid-v7-48bit-timestamp

Conversation

@tomas-zijdemans

Copy link
Copy Markdown
Contributor

generate() in @std/uuid/v7 silently truncates timestamps to 48 bits. This PR makes it throw a RangeError instead.

The timestamp is written with setBigUint64, which wraps modulo 2^64, so any bit above 48 disappears without a trace:

  • generate(2 ** 48) returns a UUID whose extractTimestamp() is 0
  • generate(Date.now() * 1000) (microseconds passed by mistake) returns a UUID carrying a garbage timestamp

Both results pass validate(), so nothing downstream catches the corruption.

The fix extends the existing guard: generate() already threw RangeError for negative and non-integer timestamps, and now also rejects values above 2 ** 48 - 1. The @throws doc states the full range, and tests cover the new throw path plus a round-trip at the maximum value.

On the behavior change: inputs that previously produced a corrupted UUID now throw. An inline comment said "truncated to 48 bits", but the truncation never made it into the public JSDoc, and it breaks the round-trip the tests already assert (extractTimestamp(generate(t)) === t). I read that comment as describing the bug, not the contract. Since 2 ** 48 - 1 milliseconds lands in the year 10889, no wall-clock timestamp is affected. Only mistakes are.

I used Claude Code to help investigate and write this change.

@github-actions github-actions Bot added the uuid label Aug 6, 2026
@codecov

codecov Bot commented Aug 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.03%. Comparing base (ca58f94) to head (b4ac8b1).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7284      +/-   ##
==========================================
- Coverage   95.03%   95.03%   -0.01%     
==========================================
  Files         617      619       +2     
  Lines       51637    51897     +260     
  Branches     9359     9410      +51     
==========================================
+ Hits        49075    49322     +247     
- Misses       2021     2030       +9     
- Partials      541      545       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant