[agent-triage] Security: uuid < 14.0.0 vulnerable to out-of-bounds write (GHSA-w5hq-g745-h8pq)

[github-actions]

Summary

Dependabot alert #242 reports that uuid versions < 14.0.0 have a buffer out-of-bounds write vulnerability (GHSA-w5hq-g745-h8pq, CWE-787, CWE-1285). The fix is to upgrade to uuid@14.0.0.

Severity: Medium (CVSS 4.0 score: 6.3)

Dependency chains

uuid is a transitive dependency — it is not declared directly in any workspace package.json. It is pulled in via two chains:

1. packages/dl-center → aws-sdk@^2.1441.0 → uuid@8.0.0 (pinned exactly)
2. Many packages → nyc@^15.1.0 → istanbul-lib-processinfo@2.0.3 → uuid@^8.3.2

Why an automated fix was not applied

The patched version requires uuid@14.0.0, which is a 6 major-version jump from the currently installed v8.x. There is no direct uuid entry in any workspace package.json to bump.

The only in-repo lever available without upgrading the direct dependencies is an npm overrides entry in the root package.json. However, applying overrides: { "uuid": "^14.0.0" } carries risk:

• aws-sdk (v2) pins uuid to exactly 8.0.0 internally. AWS SDK v2 is in long-term maintenance and is unlikely to release an update that migrates to uuid v14.
• istanbul-lib-processinfo@2.0.3 requires uuid@^8.3.2. Forcing v14 may break its internal logic if the API changed across major versions.

Applying a blind override without testing could break dl-center S3 operations and code-coverage tooling across all workspace packages.

Recommended remediation paths

1. Migrate packages/dl-center from aws-sdk (v2) to @aws-sdk/* (v3). The v3 SDK uses uuid v9+ in its own scoped dependencies and does not pin the old v8. This is the most correct long-term fix.

2. Replace nyc with c8 (or upgrade to a newer coverage tool that does not transitively pull in uuid@^8.x). c8 uses V8's built-in coverage and has no uuid dependency.

3. Add a targeted overrides entry after validating compatibility. If manual testing confirms aws-sdk v2 and istanbul-lib-processinfo still function correctly with uuid@14, add:

   "overrides": {
     "uuid": "^14.0.0"
   }

   to the root package.json and regenerate the lockfile. This approach should only be taken after explicit testing.

Alert references

• Dependabot alert #242
• GHSA-w5hq-g745-h8pq
• uuid v14.0.0 release
• Fix commit

Generated by Dependabot remediation agent · ● 511.1K · ◷