fix(deps): widen uuid override for CVE-2026-41907

[FJ-Riveros]

What

Widen the root pnpm uuid override to uuid@<11.1.1 → 11.1.1.

Why

CVE-2026-41907 still flagged residual uuid@8.3.2 after the uuid@11.1.0 → 11.1.1 override.

Test Plan

• pnpm install --lockfile-only
• Lockfile has no uuid@8
• CI lint/build passes

Security & Data Impact

Security impact: Clears buffer bounds advisory. MAJOR for prior uuid 8 consumers.
Data classification affected: none
Audit log updated: n/a

Breaking Changes

⚠️ MAJOR: transitive uuid 8 → 11.1.1 via pnpm override.

[Copilot]

Pull request overview

Updates the repo-wide pnpm override to ensure all transitive uuid versions below 11.1.1 are forced to 11.1.1, eliminating residual uuid@8.x instances still flagged by CVE-2026-41907.

Changes:

• Widened the pnpm workspace override from uuid@11.1.0 to uuid@<11.1.1, pinned to 11.1.1.
• Regenerated pnpm-lock.yaml to reflect the widened override and remove uuid@8.3.2 from the lockfile.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Widens the root uuid override selector to cover all versions <11.1.1, pinned to 11.1.1.
pnpm-lock.yaml	Updates lockfile overrides and snapshots so uuid@8.3.2 is removed and dependencies resolve to uuid@11.1.1.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[FJ-Riveros]

Closing: uuid 8 → 11.1.1 is a major bump (Solana/Kamino chains). No same-major patch for 8.x; deferring like ethena. Residual Dependabot alert for uuid@8 accepted until parents can upgrade.