The SDK depends on uuid@^9.0.1, which trips Dependabot on GHSA-w5hq-g745-h8pq — a missing buffer bounds check in uuid.v3/v5/v6 when a caller-supplied buf is passed.
The SDK only calls v4(), so it is not actually exploitable. But because the advisory range is <11.1.1, the transitive alert surfaces in every downstream project and cannot be resolved without a forced lockfile override.
Bumping uuid to ^11 (v4 API is unchanged) clears the alert cleanly. PR incoming.
The SDK depends on
uuid@^9.0.1, which trips Dependabot on GHSA-w5hq-g745-h8pq — a missing buffer bounds check inuuid.v3/v5/v6when a caller-suppliedbufis passed.The SDK only calls
v4(), so it is not actually exploitable. But because the advisory range is<11.1.1, the transitive alert surfaces in every downstream project and cannot be resolved without a forced lockfile override.Bumping
uuidto^11(v4 API is unchanged) clears the alert cleanly. PR incoming.