fix cve issue for 3.8

[yyfamazon]

Description

Resolve 10 CVE vulnerabilities by adding npm overrides and leveraging auto-resolution in package-lock.json.

Changes

package.json:

• Removed unnecessary flatted override (^3.4.0) — auto-resolves to fixed version 3.4.2 via ^3.2.9 range
• Added uuid: "11.1.1" override — forces upgrade past @cypress/request's ^8.3.2 constraint
• Added qs: ">=6.14.1" override — forces upgrade past @cypress/request's ~6.14.1 constraint

package-lock.json:

• uuid: 8.3.2 → 11.1.1
• brace-expansion: 2.1.1 → 2.1.2

CVEs Addressed

┌─────────────────────┬──────────────────────┬───────────────────┬────────────────────────────────────────────┐
│ CVE │ Package │ Fix │ Method │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2026-33228 │ flatted │ ≥3.4.2 │ Auto-resolved (lock file already at 3.4.2) │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ GHSA-5c6j-r48x-rmvq │ serialize-javascript │ ≥7.0.3 │ Existing override ^7.0.5 │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2026-27904 │ minimatch │ ≥5.1.8 │ Existing override ^5.1.9 │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2026-27903 │ minimatch │ ≥5.1.8 │ Existing override ^5.1.9 │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2026-26996 │ minimatch │ ≥5.1.7 │ Existing override ^5.1.9 │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2026-41907 │ uuid │ ≥11.1.1 │ New override 11.1.1 │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2026-34043 │ serialize-javascript │ ≥7.0.5 │ Existing override ^7.0.5 │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2026-33750 │ brace-expansion │ ≥2.0.3 │ Auto-resolved (lock file at 2.1.2) │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2025-69873 │ ajv │ ≥8.18.0 / ≥6.14.0 │ Existing overrides ^8.20.0 / ^6.15.0 │
├─────────────────────┼──────────────────────┼───────────────────┼────────────────────────────────────────────┤
│ CVE-2025-15284 │ qs │ ≥6.14.1 │ New override >=6.14.1 │
└─────────────────────┴──────────────────────┴───────────────────┴────────────────────────────────────────────┘

Notes

• uuid is pinned to exactly 11.1.1 rather than >=11.1.1 because uuid 12+/14+ are pure ESM and incompatible with @cypress/request's require('uuid') on Node 18.
• brace-expansion and flatted do not need overrides — their parent packages request ranges that already resolve to the fixed versions.

Check List

• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 7fd1b52.

Path	Line	Severity	Description
package.json	88	high	uuid added as an explicit production dependency at ^11.1.1 — a major version jump from the previously locked 8.3.2 (three major versions). The bin path also changed (dist/bin/uuid → dist/esm/bin/uuid). Dependency additions/changes must be verified by maintainers regardless of apparent legitimacy.
package.json	89	high	qs added as an explicit production dependency at ^6.15.2. Previously qs was only a transitive dependency; promoting it to a direct dependency with a pinned range is a supply chain change that must be verified.
package.json	80	high	Three existing overrides/dependencies removed in the same commit that adds new ones: serialize-javascript, flatted, and ajv. Removing security-relevant overrides (e.g., ajv version pinning) while adding new packages is a pattern worth auditing — the removals may weaken intentional version pins.
package-lock.json	7497	high	uuid resolved version jumped from 8.3.2 to 11.1.1 in the lock file — a three-major-version change. Artifact integrity and provenance should be independently verified against the npmjs registry.
package-lock.json	6422	high	qs updated from 6.14.2 to 6.15.3 and gains a new transitive dependency es-define-property. Both the version change and the introduction of a new transitive package constitute supply chain changes requiring verification.
package-lock.json	2687	high	brace-expansion updated from 2.1.1 to 2.1.2. Any dependency version change in the lock file must be flagged per mandatory supply chain review policy; maintainers should verify the integrity hash against the published registry artifact.

The table above displays the top 10 most important findings.

Total: 6 | Critical: 0 | High: 6 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.