fix CVE-2026-41907 (uuid)

[sban2009]

Summary

Addresses two issues in the dependency tree:

1. uuid vulnerability — uuid@9.x had a known moderate severity buffer bounds-check issue (GHSA-w5hq-g745-h8pq) and was deprecated upstream. Upgraded to uuid@11.1.1, the current supported CommonJS-compatible release. Only v4 is used in this codebase — no call-site changes required.

2. npm install was broken — eslint-config-airbnb-base@14 declares a peer dep of eslint ^5–7, but the project uses eslint@8. This caused ERESOLVE on a clean install. Fixed by bumping eslint-config-airbnb-base to ^15.0.0 (the first release with eslint 8 support) and eslint-config-prettier to ^9.0.0 (aligned with it).

---

Files changed

• package.json — three dep version bumps:
  • dependencies.uuid: ^9.0.1 → ^11.1.1
  • devDependencies.eslint-config-airbnb-base: ^14.2.0 → ^15.0.0
  • devDependencies.eslint-config-prettier: ^6.12.0 → ^9.0.0
• package-lock.json — regenerated by npm install and npm install uuid@11 --save

No source files, test files, type definitions, or config files were changed.

---

Test plan

1. Clean install resolves without error:

npm install
# → added 1423 packages, audited 1424 packages

2. uuid vulnerability resolved:

npm audit | grep uuid
# → no output (vuln gone)

3. Unit tests pass (896/896):

npm run test:unit
# → 896 passing (297ms), 1 pending

4. Runtime smoke test — pivot table round-trip (pivot-table-xform.js uses uuid.v4):

npx mocha --require spec/config/setup \
  spec/integration/workbook/pivot-tables.spec.js \
  spec/integration/workbook/pivot-tables-with-count.spec.js
# → 4 passing (68ms)

5. Runtime smoke test — conditional formatting round-trip (cf-rule-ext-xform.js uses uuid.v4):

npx mocha --require spec/config/setup \
  spec/unit/xlsx/xform/sheet/cf-ext/cf-rule-ext-xform.spec.js \
  spec/integration/workbook-xlsx-writer/workbook-xlsx-writer.spec.js
# → 4 passing (19ms), 20 passing (219ms)

6. Full integration suite:

npm run test:integration
# → 200 passing (2s)

---

Related to source code (for typings update)

N/A — no source or type changes.

The two files that import uuid remain unchanged:

• lib/xlsx/xform/sheet/cf-ext/cf-rule-ext-xform.js:1 — const {v4: uuidv4} = require('uuid')
• lib/xlsx/xform/pivot-table/pivot-table-xform.js:1 — const {v4: uuidv4} = require('uuid')

Both use only v4, which has an identical API in uuid@11.

---

Checklist

• Only the lines required for the fix/feature are changed (no formatter sweeps, no drive-by refactors)
• Tests use real fixture round-trip (wb.xlsx.load / writeBuffer), not synthetic model objects, where possible
• Checked open PRs (gh pr list --state open) for conflicting changes to the same files
• (If serialization is touched) Output verified to open in Excel, or soffice --headless round-trip clean — N/A, no serialization changes
• (If --no-verify was used to bypass the pre-commit hook) — not used
• (If a major dep was bumped) Runtime smoke test described above — pivot table + cf-ext integration round-trips pass