From 2f2bb20493a8b07b3d2f4818c6de9881898917f6 Mon Sep 17 00:00:00 2001
From: Kamruzzaman <kzamanbn@gmail.com>
Date: Wed, 1 Jul 2026 17:07:03 +0600
Subject: [PATCH] chore(deps): override uuid to ^11.1.1 to clear runtime
 advisory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shipped @wordpress/components pulled uuid 9.0.1 (and sockjs pulled 8.3.2),
both under the patched 11.1.1. Pin uuid via overrides so the production bundle
carries the patched version.

Result: production audit (npm audit --omit=dev) is now 0 vulnerabilities —
nothing vulnerable ships in dist/. Verified: typecheck + build pass with the
ESM-only uuid 11.

The remaining Dependabot alerts (minimatch, markdown-it, webpack-dev-server) are
build-only devDependencies hard-pinned by @wordpress/scripts' own transitive set;
they never ship and are tracked for dismissal rather than risky force-overrides.
---
 package-lock.json | 45 +++++++++++++++++----------------------------
 package.json      |  3 ++-
 2 files changed, 19 insertions(+), 29 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 95ffc05..09e683f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8381,6 +8381,19 @@
         "npm": ">=8.19.2"
       }
     },
+    "node_modules/@wordpress/dataviews/node_modules/@wordpress/components/node_modules/uuid": {
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/esm/bin/uuid"
+      }
+    },
     "node_modules/@wordpress/dataviews/node_modules/@wordpress/icons": {
       "version": "13.3.0",
       "resolved": "https://registry.npmjs.org/@wordpress/icons/-/icons-13.3.0.tgz",
@@ -8437,19 +8450,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/@wordpress/dataviews/node_modules/uuid": {
-      "version": "14.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
-      "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
-      }
-    },
     "node_modules/@wordpress/date": {
       "version": "5.49.0",
       "resolved": "https://registry.npmjs.org/@wordpress/date/-/date-5.49.0.tgz",
@@ -22758,17 +22758,6 @@
         "websocket-driver": "^0.7.4"
       }
     },
-    "node_modules/sockjs/node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/socks": {
       "version": "2.8.8",
       "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.8.tgz",
@@ -24963,16 +24952,16 @@
       }
     },
     "node_modules/uuid": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist/esm/bin/uuid"
       }
     },
     "node_modules/v8-to-istanbul": {
diff --git a/package.json b/package.json
index a1de46b..9006a73 100644
--- a/package.json
+++ b/package.json
@@ -51,6 +51,7 @@
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "@babel/runtime": "^7.26.10",
-    "serialize-javascript": "^7.0.7"
+    "serialize-javascript": "^7.0.7",
+    "uuid": "^11.1.1"
   }
 }