From 92a3a421ee7ca3e533713191608aa0cfaaad8b12 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouza.pw@gmail.com>
Date: Tue, 26 May 2026 06:21:03 -0300
Subject: [PATCH] fix(security): pin uuid >= 11.1.1 via overrides to clear
 moderate audit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds an `uuid` overrides entry so the transitive uuid dependency pulled in
by proxifly → itwcw-package-analytics → uuid (vulnerable to the missing
buffer-bounds check, GHSA-w5hq-g745-h8pq) is resolved to a patched build.

Symptom: `npm run audit:deps` (Lint job) reported 4 moderate vulnerabilities
on release/v3.8.4 because proxifly was newly added in this release.

The override uses ^14.0.0 to match the direct dependency declared in
package.json — the patched uuid 11.1.1+ surfaces under the v14 line via
the latest releases (v14.0.x continues to address the GHSA).
---
 package-lock.json | 14 --------------
 package.json      |  3 ++-
 2 files changed, 2 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 69e17b0ef7..688aff16b9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12956,20 +12956,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/itwcw-package-analytics/node_modules/uuid": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/itwcw-package-analytics/node_modules/wonderful-fetch": {
       "version": "1.3.4",
       "resolved": "https://registry.npmjs.org/wonderful-fetch/-/wonderful-fetch-1.3.4.tgz",
diff --git a/package.json b/package.json
index b33e23618f..1522de51d9 100644
--- a/package.json
+++ b/package.json
@@ -257,6 +257,7 @@
     "dompurify": "^3.4.3",
     "postcss": "^8.5.14",
     "ip-address": "10.2.0",
-    "qs": "^6.15.2"
+    "qs": "^6.15.2",
+    "uuid": "^14.0.0"
   }
 }