Declare UUID dependency for WooCommerce Admin builds by NeosinneR · Pull Request #67822 · woocommerce/woocommerce

NeosinneR · 2026-08-18T14:16:36Z

Submission Review Guidelines:

I have followed the WooCommerce Contributing Guidelines and the WordPress Coding Standards.
I have checked to ensure there aren't other open Pull Requests for the same update/change.
I have reviewed my code for security best practices.
Following the above guidelines will result in quick merges and clear and detailed feedback when appropriate.

Changes proposed in this Pull Request:

@wordpress/dataviews@10.1.7 imports uuid without declaring it. As a result, filtered installs of the WooCommerce plugin can fail to build Admin when no unrelated workspace package hoists uuid.

Patch @wordpress/dataviews@10.1.7 with the current monorepo-aligned uuid range through a version-scoped pnpm package extension. This gives the dependency to the package that imports it without affecting other DataViews versions or relying on hoisting. PR #67777 should update this package extension to the patched ^11.1.1 range after rebasing.

Relates to #67777.

How to test the changes in this Pull Request:

Using the WooCommerce Testing Instructions Guide, include your detailed testing instructions:

Run pnpm install --filter='@woocommerce/plugin-woocommerce...' --filter='compare-perf...' --frozen-lockfile.
Run pnpm --filter=@woocommerce/admin-library build.
Confirm the Admin webpack build succeeds without a Can't resolve 'uuid' error from @wordpress/dataviews.

Testing that has already taken place:

The filtered frozen install, Syncpack validation, changelog validation, and WooCommerce Admin production build passed locally.

Milestone

Automatically assign milestone for the next WooCommerce version

Note: Check the box above to have the milestone automatically assigned when merged.
Alternatively (e.g. for point releases), manually assign the appropriate milestone.

Changelog entry

Automatically create a changelog entry from the details below.

This Pull Request does not require a changelog entry. (Comment required below)

Changelog Entry Details

Significance

Patch
Minor
Major

Type

Fix - Fixes an existing bug
Add - Adds functionality
Update - Update existing functionality
Dev - Development related task
Tweak - A minor adjustment to the codebase
Performance - Address performance issues
Enhancement - Improvement to existing functionality

Message

Changelog Entry Comment

Comment

Created manually at plugins/woocommerce/changelog/fix-admin-dataviews-uuid-dependency.

Release Communication

Select the release communication labels this PR needs:

Feature Highlight - For user-facing features (what changed, user impact)
Developer Advisory - For developer-facing changes (what changed, how to detect, actions needed)

When to use each?

Feature Highlight: New features, UI changes, or improvements that merchants/store owners will notice.

Example: "New bulk editing for products", "Improved checkout performance"

Developer Advisory: Breaking changes, deprecations, or changes that affect themes/plugins/extensions.

Example: "Hook signature change", "Deprecated filter", "REST API field removed"

Selected labels are applied when the pull request is merged.

Use of AI Tools

Codex was used to investigate the CI failure, prepare the dependency change, run local validation, and draft this PR.

github-actions · 2026-08-18T14:31:54Z

Testing Guidelines

Hi @kalessil @gigitux ,

Apart from reviewing the code changes, please make sure to review the testing instructions (Guide) and verify that relevant tests (E2E, Unit, Integration, etc.) have been added or updated as needed.

Reminder: PR reviewers are required to document testing performed. This includes:

🖼️ Screenshots or screen recordings.
📝 List of functionality tested / steps followed.
🌐 Site details (environment attributes such as hosting type, plugins, theme, store size, store age, and relevant settings).
🔍 Any analysis performed, such as assessing potential impacts on environment attributes and other plugins, conducting performance profiling, or using LLM/AI-based analysis.

⚠️ Within the testing details you provide, please ensure that no sensitive information (such as API keys, passwords, user data, etc.) is included in this public issue.

coderabbitai · 2026-08-18T14:33:07Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: c0604af8-62c1-4216-ba84-eea2c3425556

📥 Commits

Reviewing files that changed from the base of the PR and between d59d1c3 and b7e5344.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The pnpm configuration adds uuid@^9.0.1 to @wordpress/dataviews@10.1.7. A patch-level development changelog entry documents the dependency requirement.

Changes

WooCommerce Admin dependency

Layer / File(s)	Summary
Declare UUID dependency `package.json`, `plugins/woocommerce/changelog/fix-admin-dataviews-uuid-dependency`	The pnpm configuration injects `uuid@^9.0.1` into `@wordpress/dataviews@10.1.7`. The changelog records the patch-level development change.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to b7e53

This PR adds the missing UUID dependency for the affected WooCommerce Admin build without changing product behavior. No actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

woocommerce/woocommerce#67777: Updates the pinned uuid version in related dependency configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the UUID dependency declaration for WooCommerce Admin builds.
Description check	✅ Passed	The description explains the dependency issue, the proposed version-scoped fix, testing instructions, and validation results.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/admin-dataviews-uuid-dependency

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-18T14:36:33Z

Test using WordPress Playground

The changes in this pull request can be previewed and tested using a WordPress Playground instance.
WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Test this pull request with WordPress Playground.

Note that this URL is valid for 30 days from when this comment was last updated. You can update it by closing/reopening the PR or pushing a commit that changes plugin code.

github-actions · 2026-08-18T14:39:23Z

Size Change: 0 B 🆕

Total Size: 0 B

_{compressed-size-action}

tyxla

Have you also considered opening a PR in Gutenberg to add that dependency to the dataviews package? Fixing it here seems like the wrong place.

cc @manzoorwanijk @ntsekouras @oandregal

NeosinneR · 2026-08-18T20:53:44Z

@tyxla this is already tracked in WordPress/gutenberg#67864 which is ~20 months old issue, and doesn't look like an easy fix I'd consider picking. There was already similar attempt at fixing different missing dependency in WordPress/gutenberg#76051 which was closed, so I assume fixing the symptoms by adding the uuid might result in similar closure.

manzoorwanijk · 2026-08-18T22:14:01Z

I don’t see the dataviews package using uuid in the latest version.

I think a better fix here would be to update the package to the latest version instead of trying to patch an older version.

NeosinneR · 2026-08-19T05:59:32Z

I don’t see the dataviews package using uuid in the latest version.

@manzoorwanijk it's not direct dependency, it's consumed through @wordpress/components - you can search it even in the latest 18.0.0 DataViews package.

That's what WordPress/gutenberg#67864 is about I think, that DataViews package consumes dependencies it doesn't declare.

As for this specific PR, I'm working on updating vulnerable packages reported by Dependabot in #67777 - the goal is not to make big changes (such as bumping DataViews package from 10.1.7 to 18.0.0, which would still fail btw), but to close security issues. And this PR is only to make the comparison against trunk (where the build fails) to work.

NeosinneR · 2026-08-19T06:02:57Z

@gigitux @kalessil the failing e2e is unrelated to this PR and is caused by yesterday's MailPoet release. It'll fix itself with WordPress 7.1 release, which should be today (more context in p1787086075234359-slack-C03CPM3UXDJ).

kalessil

LGTM, pre-approving (CI is still running).

manzoorwanijk · 2026-08-19T21:15:40Z

Ideally, @wordpress/dataviews should declare all of its dependencies that are imported in /wp. The tool we use in Gutenberg to audit published dependencies had a bug which I have now fixed in mawesomedev/mawesome#74 and it should now flag all the missing deps, not just uuid.

You can see the issues now in the playground.

BEFORE	AFTER

manzoorwanijk · 2026-08-20T00:18:41Z

I have now created a PR to actually fix it in Gutenberg - WordPress/gutenberg#81843

kalessil · 2026-08-20T06:46:27Z

@manzoorwanijk: Nice, thanks!

Also, I believe this doesn't block merging this PR (the admin dependency bump is a high-risk endeavor that will also derail efforts to address the current focus: fixing high-severity dependency reports by Dependabot)?

manzoorwanijk · 2026-08-20T09:52:48Z

Also, I believe this doesn't block merging this PR (the admin dependency bump is a high-risk endeavor that will also derail efforts to address the current focus: fixing high-severity dependency reports by Dependabot)?

Absolutely. I just wanted to fix the issue at the source, so that we don’t need such patching moving forward.

NeosinneR added 2 commits August 18, 2026 16:15

Declare UUID dependency for Admin builds

5dfb1dd

Add changelog for Admin UUID dependency

d59d1c3

github-actions Bot added plugin: woocommerce Issues related to the WooCommerce Core plugin. focus: monorepo infrastructure Issues and PRs related to monorepo tooling. labels Aug 18, 2026

NeosinneR mentioned this pull request Aug 18, 2026

Update npm dependencies without overrides #67777

Closed

4 of 8 tasks

NeosinneR marked this pull request as ready for review August 18, 2026 14:31

NeosinneR requested a review from a team as a code owner August 18, 2026 14:31

NeosinneR removed the request for review from a team August 18, 2026 14:31

tyxla reviewed Aug 18, 2026

View reviewed changes

NeosinneR requested review from gigitux and kalessil August 19, 2026 06:01

kalessil requested changes Aug 19, 2026

View reviewed changes

Comment thread plugins/woocommerce/client/admin/package.json Outdated

NeosinneR mentioned this pull request Aug 19, 2026

Resolve high-severity npm alerts #67844

Merged

1 of 5 tasks

Scope UUID workaround to DataViews 10.1.7

b7e5344

kalessil approved these changes Aug 19, 2026

View reviewed changes

kalessil reviewed Aug 19, 2026

View reviewed changes

Comment thread package.json

Merge branch 'trunk' into fix/admin-dataviews-uuid-dependency

13d8fcf

NeosinneR merged commit 053a219 into trunk Aug 20, 2026
261 of 263 checks passed

NeosinneR deleted the fix/admin-dataviews-uuid-dependency branch August 20, 2026 10:02

github-actions Bot added this to the 11.2.0 milestone Aug 20, 2026

Conversation

NeosinneR commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Submission Review Guidelines:

Changes proposed in this Pull Request:

How to test the changes in this Pull Request:

Testing that has already taken place:

Milestone

Changelog entry

Significance

Type

Message

Comment

Release Communication

Use of AI Tools

Uh oh!

github-actions Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing Guidelines

Uh oh!

coderabbitai Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test using WordPress Playground

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

tyxla left a comment

Choose a reason for hiding this comment

Uh oh!

NeosinneR commented Aug 18, 2026

Uh oh!

manzoorwanijk commented Aug 18, 2026

Uh oh!

NeosinneR commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NeosinneR commented Aug 19, 2026

Uh oh!

Uh oh!

kalessil left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

manzoorwanijk commented Aug 19, 2026

Uh oh!

manzoorwanijk commented Aug 20, 2026

Uh oh!

kalessil commented Aug 20, 2026

Uh oh!

manzoorwanijk commented Aug 20, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

NeosinneR commented Aug 18, 2026 •

edited

Loading

github-actions Bot commented Aug 18, 2026 •

edited

Loading

coderabbitai Bot commented Aug 18, 2026 •

edited

Loading

github-actions Bot commented Aug 18, 2026 •

edited

Loading

NeosinneR commented Aug 19, 2026 •

edited

Loading