fix(deps): widen uuid 11.x override for CVE-2026-41907 - #175
Merged
Conversation
Replace uuid@11.1.0 pin with uuid@>=11.0.0 <11.1.1 → 11.1.1. Residual uuid@8 major bump remains deferred.
There was a problem hiding this comment.
Pull request overview
This PR updates pnpm dependency overrides to broaden the uuid 11.x override range so vulnerable uuid@11.0.x / uuid@11.1.0 resolutions are forced to 11.1.1, addressing CVE-2026-41907 / GHSA-w5hq-g745-h8pq without upgrading uuid@8 to a new major.
Changes:
- Widen
uuidoverride selector from an exact11.1.0match to a>=11.0.0 <11.1.1range, mapping to11.1.1. - Regenerate lockfile (also updates
minimatchtransitive resolution from10.2.4to10.2.6).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Broadens the uuid override selector to cover all vulnerable 11.0.x / 11.1.0 resolutions and map them to 11.1.1. |
| pnpm-lock.yaml | Updates the recorded overrides and lockfile resolutions to reflect the widened uuid override and refreshed transitive versions. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
1291
to
1293
| minimatch@10.2.6: | ||
| resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} | ||
| engines: {node: 18 || 20 || >=22} |
ElliotWood13
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Widen uuid override from exact
uuid@11.1.0touuid@>=11.0.0 <11.1.1→11.1.1.Why
Clears remaining 11.x resolutions for CVE-2026-41907 / GHSA-w5hq-g745-h8pq without forcing uuid 8 → 11.
Test plan
pnpm install --lockfile-onlyuuid@11.1.1(no11.1.0/11.0.x)Security & Data Impact
Security impact: Clears uuid 11.x advisory slice. Residual uuid@8 deferred (major).
Data classification affected: none
Audit log updated: n/a
Breaking Changes
None for this change. uuid@8 → 11 remains MAJOR BUMP DEFERRED.