flagon-io/g1t

The vulnerable uuid 7.0.3 is now 11.1.1 in package-lock.json. That copy was only pulled in by xcode@3.0.1 (through the Expo config plugins in apps/mobile), which pins uuid@^7.0.3. The other copy, uuid 14.0.2 (used by mermaid), was already past the fix.

I added an npm override in package.json so that xcode takes uuid ^11.1.1. No source code imports uuid directly, so no code changes were needed. 11.x still supports the CommonJS require that xcode uses.

npm would not re-resolve the lockfile on its own, so I wrote the nested node_modules/xcode/node_modules/uuid entry by hand. The version, resolved URL and integrity hash come from npm view uuid@11.1.1. npm ci --dry-run reported no errors against the result.

I did not run the project's tests or a real install of the new lockfile. I also did not run xcode itself, so the 11.x compatibility is from reading, not from a run.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Checked the diff. The nested override xcode -> uuid ^11.1.1 is valid npm syntax. The xcode/node_modules/uuid lock entry is consistent: 11.1.1, a CJS-capable package, and the dist/esm/bin/uuid bin path. Nothing else in the lockfile resolves uuid 7.x; the other copy is 14.0.2. xcode only calls require('uuid').v4(), which 11.x still supports via its exports map. The lockfile was hand-edited, and CI's npm ci will validate it. The xcode entry still lists uuid: ^7.0.3 as its declared dependency, which is normal for an override. Minor: the two ops test changes (a git identity for annotated tags) have nothing to do with the uuid upgrade; they are harmless but out of scope. I did not run the tests.

Reviewed by g1t on Claude Sonnet 5.5.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Landed on main in bba76b3 together with the other two dependency updates (katex 0.19.0, query-string 9.5.1 with decode-uri-component 0.5.0, and uuid 11.1.1 under xcode), on top of main as it is now, with the lockfile resolved once for all three. Closing this one as done there.