fix(#1323): fixing security findings in frontend

[paulushcgcj]

Description

Fixes the open Dependabot vulnerability CVE-2026-41907 in the frontend dependency tree.

CVE: CVE-2026-41907
Package: uuid
Severity: Moderate
Vulnerable range: <11.1.1
Fix version: 11.1.1

Root cause

uuid@8.3.2 was pulled in transitively via:

nyc@17.1.0 → istanbul-lib-processinfo@2.0.3 → uuid@8.3.2

istanbul-lib-processinfo@latest (3.0.0) still declares uuid@^8.3.2, so no patched parent exists.

Fix applied (Step D — last-resort override)

An exact-pinned overrides entry was added to frontend/package.json:

"uuid": "11.1.1"

This forces the entire dependency tree to use uuid@11.1.1. The override crosses a major version boundary (8.x → 11.x); this was confirmed acceptable by the repository maintainer before applying.

Version Resolution Details

Package: uuid

• Specified Fix Version: 11.1.1 (exact pin, no caret or tilde)
• Actual Resolved Version: 11.1.1 ✅
• Verification: npm ls uuid shows all three occurrences at 11.1.1 overridden / deduped
• npm audit result: found 0 vulnerabilities

Override removal

A follow-up issue has been opened at #1325 to remove this override once istanbul-lib-processinfo (or nyc) ships a version that depends on uuid >=11.1.1 natively.

Fixes #1323

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• npm install completed successfully with 0 vulnerabilities

• npm ls uuid confirms all instances resolve to 11.1.1

• git diff --stat package-lock.json confirms package-lock.json was modified

• No new tests are required

• Manual tests (description below)

Manual: ran npm audit before and after — before showed 1 moderate vulnerability (CVE-2026-41907); after shows 0.

Checklist

• I have read the CONTRIBUTING doc
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes
• Any dependent changes have already been accepted and merged

Further comments

This is a security-only patch. Only frontend/package.json (override entry) and frontend/package-lock.json (lock update) are changed. No application code was modified.

Closes #1323

---

Thanks for the PR!

Deployments, as required, will be available below:

• Hybrid Backend
• Hybrid Frontend
• Postgres Backend
• Postgres Frontend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull request overview

Updates the frontend’s npm dependency resolution to remediate CVE-2026-41907 by forcing uuid to a patched version across the dependency tree.

Changes:

• Add an exact overrides pin for uuid to 11.1.1 in frontend/package.json.
• Update frontend/package-lock.json so the resolved uuid version is 11.1.1 (including removing the previously nested uuid@8.3.2 under istanbul-lib-processinfo).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
frontend/package.json	Adds overrides.uuid = 11.1.1 to force patched uuid version across installs.
frontend/package-lock.json	Lockfile updates reflecting uuid@11.1.1 resolution and removal of the vulnerable nested uuid@8.3.2.

Files not reviewed (1)

• frontend/package-lock.json: Language not supported