[BUG] UUID <v14 has npm audit warning

[Develliot]

Is there an existing issue for this?

• I have searched the existing issues

SDK Version

6.3.1

Current Behavior

uuid <14.0.0
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - GHSA-w5hq-g745-h8pq

Expected Behavior

no warnings when running npm audit

Steps To Reproduce

1. install latest version of @optimizely/optimizely-sdk
2. run 'npm audit'

SDK Type

Browser

Node Version

Node 22 and Node 24

Browsers impacted

n/a

Link

No response

Logs

No response

Severity

Minor issue

Workaround/Solution

none

Recent Change

No response

Conflicts

No response

[raju-opti]

Hey @Develliot , thank you for reporting this. We only use uuid.v4, so it should not have any security implications for the sdk. We will upgrade to 13.0.1 in the next release (coming soon!) which has fix for this.