From 8add58703a03452b4336c0c0e9b012239a8e33a2 Mon Sep 17 00:00:00 2001
From: aamoghS <aamoghsawantt@gmail.com>
Date: Thu, 24 Sep 2026 22:28:26 -0400
Subject: [PATCH] fix(deps): override gaxios's uuid to 11.1.1 for GHSA advisory

@google-cloud/storage 8.2 (latest) pulls google-auth-library 9, which
pulls gaxios 6.7.1, which pins uuid ^9.0.1. Dependabot flags uuid <11.1.1
(missing buffer bounds check in v3/v5/v6 when buf is passed).

gaxios only calls uuid.v4() for a multipart boundary, so the app was not
exposed, but the override clears the alert and uuid 11's CommonJS build
exports v4 the same way. Scoped to gaxios>uuid so nothing else moves.
---
 package.json   |  3 ++-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index a69e48ec..8c6f3f6f 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,8 @@
       "undici": "^6.27.0",
       "sharp": "^0.35.0",
       "vite": "^7.3.5",
-      "brace-expansion": "^5.0.9"
+      "brace-expansion": "^5.0.9",
+      "gaxios>uuid": "^11.1.1"
     }
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 89a63c17..8e650928 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -18,6 +18,7 @@ overrides:
   sharp: ^0.35.0
   vite: ^7.3.5
   brace-expansion: ^5.0.9
+  gaxios>uuid: ^11.1.1
 
 importers:
 
@@ -4611,9 +4612,8 @@ packages:
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
-  uuid@9.0.1:
-    resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
-    deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
+  uuid@11.1.1:
+    resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==}
     hasBin: true
 
   vite@7.3.6:
@@ -7393,7 +7393,7 @@ snapshots:
       https-proxy-agent: 7.0.6
       is-stream: 2.0.1
       node-fetch: 2.7.0
-      uuid: 9.0.1
+      uuid: 11.1.1
     transitivePeerDependencies:
       - encoding
       - supports-color
@@ -8828,7 +8828,7 @@ snapshots:
 
   util-deprecate@1.0.2: {}
 
-  uuid@9.0.1: {}
+  uuid@11.1.1: {}
 
   vite@7.3.6(@types/node@22.20.4)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.15):
     dependencies: