chore(main): release 14.0.0 (#926)

github-actions[bot] · broofa · web-flow · commit 7c1ea087a814 · 2026-04-19T05:14:58.000-10:00
* chore(main): release 14.0.0

---------

Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]@users.noreply.github.com&gt;
Co-authored-by: Robert Kieffer &lt;robert@broofa.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Change Log
 
+## [14.0.0](https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0) (2026-04-19)
+
+
+### Security
+
+* Fixes [GHSA-w5hq-g745-h8pq](https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq): `v3()`, `v5()`, and `v6()` did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid `offset` was provided. A `RangeError` is now thrown if `offset < 0` or `offset + 16 > buf.length`.
+
+
+### ⚠ BREAKING CHANGES
+
+* `crypto` is now expected to be globally defined (requires node@20+) ([#935](https://github.com/uuidjs/uuid/issues/935))
+* drop node@18 support ([#934](https://github.com/uuidjs/uuid/issues/934))
+* upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years
+
 ## [13.0.0](https://github.com/uuidjs/uuid/compare/v12.0.0...v13.0.0) (2025-09-08)
 
 
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "uuid",
-  "version": "13.0.0",
+  "version": "14.0.0",
   "description": "RFC9562 UUIDs",
   "type": "module",
   "funding": [

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "uuid",`
`3`		`- "version": "13.0.0",`
	`3`	`+ "version": "14.0.0",`
`4`	`4`	`"description": "RFC9562 UUIDs",`
`5`	`5`	`"type": "module",`
`6`	`6`	`"funding": [`