Possible fix(deps): 4 vulnerable dependencies in pnpm-lock.yaml

[begininvoke]

This might be a false positive, but pnpm-lock.yaml around line 1 looked worth a second pair of eyes.

The uuid package (version 8.3.2) contains a buffer over‑write issue in the v3, v5, and v6 generation functions. These functions accept user‑provided output buffers but do not validate that the buffer size or offset are within range, allowing writes beyond the buffer's bounds. This can cause silent partial writes, corrupting adjacent memory, and may lead to crashes or remote code execution. Updating to a version that includes the fix (14.0.0 or later) eliminates the out‑of‑range write checks and resolves the vulnerability.

Something like this might fix it:

--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1,4 +1,4 @@
 lockfileVersion: 5.4
 importers:
   root:
     specifiers:
-      uuid: ^8.3.2
+      uuid: ^14.0.0
     dependencies:
       uuid:
-        version: 8.3.2
+        version: 14.0.0

For reference: rule CVE-2026-41907. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.