`@amazon-dax-sdk/lib-dax` uses a legacy `uuid` version

[SotoPedro]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

As of now, I haven’t found an actively maintained repository or version of @amazon-dax-sdk/lib-dax that fully supports the current dependency ecosystem.

This package has a transitive dependency on uuid, which has been upgraded to v14.x. Starting from v12, uuid is ESM-only and no longer supports CommonJS. However, @amazon-dax-sdk/lib-dax still relies on require("uuid"), which creates a runtime incompatibility in environments that execute code as CommonJS.

Attempts to resolve this via dependency overrides are not viable:

Forcing a newer uuid version (v12+) results in runtime failures due to ESM/CommonJS mismatch.
Downgrading uuid to a CommonJS-compatible version (v11 or below) is blocked by security policies, as those versions are flagged as vulnerable dependencies.

As a result, we are currently in a dependency deadlock:

The DAX SDK requires CommonJS-compatible uuid
The only supported uuid versions are ESM-only

This leads to build and runtime failures, particularly in Lambda environments where the dependency tree is resolved from the deployed layer.

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@amazon-dax-sdk/lib-dax

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

v22.0.0

Reproduction Steps

• install @amazon-dax-sdk/lib-dax
• run npm audit

Observed Behavior

• @amazon-dax-sdk/lib-dax depends on vulnerable version of uuid

Expected Behavior

• correctly use the uuid package to generate unique identifiers, if not rely on crypto

Possible Solution

No response

Additional Information/Context

No response

[aBurmeseDev]

Hi @SotoPedro, thanks for checking in.
The @amazon-dax-sdk/lib-dax package is maintained by the DAX team separately from this repo. We don't own or publish the @amazon-dax-sdk/* packages here.

I'd recommend reaching out through one of these channels to get this in front of the right team:

• AWS Support (https://console.aws.amazon.com/support/)
• AWS re:Post (https://repost.aws/)

Closing this issue as it's outside the scope of this repo.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.