Skip to content

chore(deps): remove uuid override once istanbul-lib-processinfo is patched #1325

Description

@paulushcgcj

Bug Summary

A temporary overrides entry for uuid ("uuid": "11.1.1") was added to frontend/package.json as a workaround for CVE-2026-41907. This override forces nyc → istanbul-lib-processinfo to use the patched major version (11.x) even though istanbul-lib-processinfo@latest still declares uuid@^8.3.2.

Describe the Bug

The upstream package istanbul-lib-processinfo has not yet updated its uuid dependency to >=11.1.1. The override was added in fix #1323 to unblock the Dependabot alert. Once istanbul-lib-processinfo (or its parent nyc) ships a version that depends on uuid >=11.1.1, the override should be removed to avoid masking future version conflicts.

Steps to Reproduce

  1. Check istanbul-lib-processinfo on npm for a release with uuid >= 11.1.1 in its dependencies.
  2. Confirm nyc references that version.
  3. Remove "uuid": "11.1.1" from overrides in frontend/package.json.
  4. Run npm install and npm audit to confirm no uuid vulnerability remains.

Expected Behavior

frontend/package.json should not require a cross-major uuid override once upstream ships its own fix.

Actual Behavior

The override is currently required to keep CVE-2026-41907 resolved while istanbul-lib-processinfo remains unpatch.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions