Bug Summary
A temporary overrides entry for uuid ("uuid": "11.1.1") was added to frontend/package.json as a workaround for CVE-2026-41907. This override forces nyc → istanbul-lib-processinfo to use the patched major version (11.x) even though istanbul-lib-processinfo@latest still declares uuid@^8.3.2.
Describe the Bug
The upstream package istanbul-lib-processinfo has not yet updated its uuid dependency to >=11.1.1. The override was added in fix #1323 to unblock the Dependabot alert. Once istanbul-lib-processinfo (or its parent nyc) ships a version that depends on uuid >=11.1.1, the override should be removed to avoid masking future version conflicts.
Steps to Reproduce
- Check
istanbul-lib-processinfo on npm for a release with uuid >= 11.1.1 in its dependencies.
- Confirm
nyc references that version.
- Remove
"uuid": "11.1.1" from overrides in frontend/package.json.
- Run
npm install and npm audit to confirm no uuid vulnerability remains.
Expected Behavior
frontend/package.json should not require a cross-major uuid override once upstream ships its own fix.
Actual Behavior
The override is currently required to keep CVE-2026-41907 resolved while istanbul-lib-processinfo remains unpatch.
Bug Summary
A temporary
overridesentry foruuid("uuid": "11.1.1") was added tofrontend/package.jsonas a workaround for CVE-2026-41907. This override forcesnyc → istanbul-lib-processinfoto use the patched major version (11.x) even thoughistanbul-lib-processinfo@lateststill declaresuuid@^8.3.2.Describe the Bug
The upstream package
istanbul-lib-processinfohas not yet updated itsuuiddependency to>=11.1.1. The override was added in fix #1323 to unblock the Dependabot alert. Onceistanbul-lib-processinfo(or its parentnyc) ships a version that depends onuuid >=11.1.1, the override should be removed to avoid masking future version conflicts.Steps to Reproduce
istanbul-lib-processinfoon npm for a release withuuid >= 11.1.1in itsdependencies.nycreferences that version."uuid": "11.1.1"fromoverridesinfrontend/package.json.npm installandnpm auditto confirm no uuid vulnerability remains.Expected Behavior
frontend/package.jsonshould not require a cross-majoruuidoverride once upstream ships its own fix.Actual Behavior
The override is currently required to keep CVE-2026-41907 resolved while
istanbul-lib-processinforemains unpatch.