fix(security): pin uuid >= 11.1.1 via overrides to clear moderate audit

Adds an `uuid` overrides entry so the transitive uuid dependency pulled in
by proxifly → itwcw-package-analytics → uuid (vulnerable to the missing
buffer-bounds check, GHSA-w5hq-g745-h8pq) is resolved to a patched build.

Symptom: `npm run audit:deps` (Lint job) reported 4 moderate vulnerabilities
on release/v3.8.4 because proxifly was newly added in this release.

The override uses ^14.0.0 to match the direct dependency declared in
package.json — the patched uuid 11.1.1+ surfaces under the v14 line via
the latest releases (v14.0.x continues to address the GHSA).
This commit is contained in:
diegosouzapw
2026-05-26 06:21:03 -03:00
parent 3f3ab87bf0
commit 92a3a421ee
2 changed files with 2 additions and 15 deletions

14
package-lock.json generated
View File

@@ -12956,20 +12956,6 @@
"node": ">= 0.6"
}
},
"node_modules/itwcw-package-analytics/node_modules/uuid": {
"version": "9.0.1",
"resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
"integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
"deprecated": "uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
"funding": [
"https://github.com/sponsors/broofa",
"https://github.com/sponsors/ctavan"
],
"license": "MIT",
"bin": {
"uuid": "dist/bin/uuid"
}
},
"node_modules/itwcw-package-analytics/node_modules/wonderful-fetch": {
"version": "1.3.4",
"resolved": "https://registry.npmjs.org/wonderful-fetch/-/wonderful-fetch-1.3.4.tgz",

View File

@@ -257,6 +257,7 @@
"dompurify": "^3.4.3",
"postcss": "^8.5.14",
"ip-address": "10.2.0",
"qs": "^6.15.2"
"qs": "^6.15.2",
"uuid": "^14.0.0"
}
}