security: uuid library has a CVE with CVSS score of 7.5

[alexleach]

Describe the bug
I am using this library in one of my projects, and I received a dependabot alert about vulnerable versions of the uuid library.

See https://nvd.nist.gov/vuln/detail/CVE-2026-41907

I see there are a couple of old dependabot PRs already here...

Is anyone maintaining this repository currently? If so, please could someone pick up the task of version bumping? Happy to submit a PR if that would help, as I've been working with it recently.

[reubenae]

Hey @alexleach
I just merged a dependabot PR which should reactivate it and trigger the ones you're talking about.
FWIW I don't think there is a genuine opportunity for any kind of injection with the vulnerabilities and this library, since it is supposed to run only in a clients browser. But, probably won't hurt.

[alexleach]

Nice one, thanks for the rapid response! 🙂

[reubenae]

Looks like the build fails due to a lack of permission and, well, I don't work at Intuit (and haven't done for four years!)

@skodamarthi could you take a look?

[reubenae]

@alexleach if this is bothering you fft submit a PR and tag me on it, and I can merge that

[alexleach]

Looks like dependabot has kicked in now. uuid is bumped in #207

[reubenae]

Yeah, the build is failing because of an org-wide lack of permissions. @skodamarthi ^

[alexleach]

Just going through my notifications and saw this was still open.

Did you hear back from anyone (@skodamarthi ?) about regaining org-wide access?