force uuid package >= 11.1.1

[kenjenkins]

Summary

Force the npm uuid package to at least v11.1.1.

Related

• https://github.com/pomerium/documentation/security/dependabot/151

AI disclosure

none

Checklist

• reference any related issues
• disclosed AI usage (or wrote "none") per AI_POLICY.md

[netlify]

✅ Deploy Preview for pomerium-docs ready!

Name	Link
🔨 Latest commit	21ccd2b
🔍 Latest deploy log	https://app.netlify.com/projects/pomerium-docs/deploys/6a56c40ff1a0d40008597ca4
😎 Deploy Preview	https://deploy-preview-2316--pomerium-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

Greptile Summary

This PR pins uuid to >=11.1.1 via yarn's resolutions field to address a Dependabot security advisory. The lockfile collapses two previously separate uuid entries (v8.3.2 and v11.1.0) into a single resolved version, v14.0.1.

• package.json: Adds "uuid": ">=11.1.1" to resolutions, consistent with the existing pattern for other security-patched transitive deps (diff, dompurify, qs, etc.).
• yarn.lock: All four uuid specifier keys—including the exact-version uuid@8.3.2 pin from a transitive dependency—now resolve to 14.0.1, which is the correct yarn-v1 resolutions behaviour.

Confidence Score: 5/5

Straightforward security patch that follows the project's established resolutions pattern; no application logic is modified.

The change is limited to forcing a higher uuid version through yarn resolutions, which is the same mechanism already used for a dozen other packages in this repo. The lockfile correctly reflects the consolidated resolution at v14.0.1, and uuid's core API (v1/v4/v5) has remained stable across the v8→v14 range, so transitive consumers are unlikely to break. This site uses uuid only as a deep transitive dependency of Docusaurus tooling, not directly.

No files require special attention; both package.json and yarn.lock changes are mechanical and correct.

Important Files Changed

Filename	Overview
package.json	Adds uuid: >=11.1.1 to the resolutions field, forcing all transitive dependents of uuid to receive a patched version; consistent with other security-driven resolutions already present.
yarn.lock	Consolidates two separate uuid entries (v8.3.2 and v11.1.0) into a single v14.0.1 entry, satisfying all four specifier keys including the exact-version uuid@8.3.2 pin; this is the expected yarn-v1 resolutions outcome.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[yarn install] --> B{resolutions field\nin package.json}
    B -->|uuid: >=11.1.1| C[Yarn resolution engine]

    subgraph BEFORE ["Before this PR"]
        D1["uuid@8.3.2\n→ resolved 8.3.2"]
        D2["uuid@^11.1.0 || ^12 || ...\n→ resolved 11.1.0"]
    end

    subgraph AFTER ["After this PR"]
        E1["uuid@8.3.2 / uuid@^8.3.2 / uuid@>=11.1.1 / uuid@^11.1.0||^12||...\n→ all resolved 14.0.1"]
    end

    C --> AFTER
    style AFTER fill:#d4edda,stroke:#28a745
    style BEFORE fill:#f8d7da,stroke:#dc3545

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[yarn install] --> B{resolutions field\nin package.json}
    B -->|uuid: >=11.1.1| C[Yarn resolution engine]

    subgraph BEFORE ["Before this PR"]
        D1["uuid@8.3.2\n→ resolved 8.3.2"]
        D2["uuid@^11.1.0 || ^12 || ...\n→ resolved 11.1.0"]
    end

    subgraph AFTER ["After this PR"]
        E1["uuid@8.3.2 / uuid@^8.3.2 / uuid@>=11.1.1 / uuid@^11.1.0||^12||...\n→ all resolved 14.0.1"]
    end

    C --> AFTER
    style AFTER fill:#d4edda,stroke:#28a745
    style BEFORE fill:#f8d7da,stroke:#dc3545

Loading

_{Reviews (1): Last reviewed commit: "force uuid package >= 11.1.1" | Re-trigger Greptile}