fix: override transitive uuid 8.3.2 -> 11.1.1 (major, dev-only via nyc)

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-19.
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
uuid (transitive, dev)	npm	Major	8.3.2 → 11.1.1	Medium	151d	Dependabot, Wiz	GHSA-w5hq-g745-h8pq (CVE-2026-41907); also clears the Wiz "End-of-Life Version of Library" finding for uuid 8.3.2

How: the only uuid@^8 consumer is istanbul-lib-processinfo@2.0.3. It comes in through the nyc devDependency, and no script in this repo currently runs nyc. It pins uuid ^8.3.2, so no fix exists inside that range. Added a Yarn resolution:

"resolutions": { "**/istanbul-lib-processinfo/uuid": "^11.1.1" }

yarn.lock now folds uuid@^8.3.2 into the existing uuid@11.1.1 entry, which the extension's direct uuid dependency already uses, so no new package versions come in. istanbul-lib-processinfo only calls const { v4: uuidv4 } = require('uuid'), and uuid 11's CommonJS build still exports that.

2026-10-19 update: the branch is still current with main (0 commits behind) and Dependabot alert #216 is still open, so the change is the same. Install, build, lint and tests were re-run today. The Wiz MCP server was unavailable on 2026-10-12 and 2026-10-19, so the Wiz attribution comes from the 2026-10-05 reconcile.

Deferred / excluded findings

• The minor/patch findings (handlebars, tar, axios, form-data, brace-expansion, js-yaml, fast-uri, ip-address, qs, browserslist, @xmldom/xmldom, baseline-browser-mapping) are in the separate minor/patch PR fix: bump vulnerable npm dependencies (tar, axios, form-data, brace-expansion, js-yaml, fast-uri, ip-address, and more) #172.
• Dependabot PR Bump uuid from 11.1.1 to 14.0.0 in the npm_and_yarn group across 1 directory #166 (direct uuid 11.1.1 → 14.0.0) is unrelated to this transitive copy. It isn't a security fix, because the direct uuid 11.1.1 is already patched.

Verification

• Install: ✅ yarn install --frozen-lockfile (Yarn 1.22.22, Node 24.19.0)
• Build: ✅ yarn build:setup && yarn compile (webpack)
• Tests: ✅ xvfb-run -a yarn test locally (VS Code test host, 13 passing). The 2026-09-28 targeted check also passed: nyc --silent node a.js exits 0 with istanbul-lib-processinfo resolving uuid@11.1.1.
• Lint: ✅ yarn lint and yarn prettier:check. The repo's pre-commit hooks can't be installed in the sandbox because the hook repos can't be cloned, so the eslint and prettier runs above stand in for them.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring