fix: bump uuid to ^11.1.1 across the monorepo

[cryptodev-2s]

Explanation

Clears GHSA-w5hq-g745-h8pq, which accounts for 25 of the repo's 155 open Dependabot alerts. The advisory is a missing buffer bounds check in v3/v5/v6 when buf is supplied; core only uses v1 and v4, so nothing here was exploitable, but the alerts need clearing.

Dependabot proposed ^14.0.2 in #10147. This goes to ^11.1.1 instead, the lowest patched version, because uuid is ESM-only from v12 onwards and our Jest setup cannot load an ESM-only dependency without transforming it: jest.requireActual('uuid') fails with SyntaxError: Unexpected token 'export'. Moving to v14 is doable but needs transformIgnorePatterns work, which does not belong in a security fix.

Also drops @types/uuid from 11 manifests, since uuid has bundled its own types since v10.

packages/utils/src/fs.test.ts needed a small helper: v4 is overloaded and jest.spyOn resolves to the last overload, which returns Uint8Array rather than string. That is true in both v11 and v14, so it is not specific to the version chosen.

Client impact

Checked against the clients' lockfiles rather than assumed. Both already resolve uuid 11, so this introduces nothing new and core's 9.0.1 copy should collapse into the 11.1.1 already present.

client	uuid versions already resolved
metamask-extension	3.2.1, 3.4.0, 8.3.2, 9.0.1, 11.0.3, 11.1.1
metamask-mobile	3.3.2, 7.0.3, 8.3.2, 9.0.0, 9.0.1, 11.0.3, 11.1.0, 14.0.1

Worth noting for anyone tempted by v14 later: metamask-extension has no uuid 14 anywhere and pins a transitive gridplus-sdk/uuid@^13.0.0 back down to ^8.3.2.

References

Supersedes #10147. Part of WPC-1161.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Monorepo-wide dependency and typing cleanup with no production API changes; usage stays on v4/v1-style imports clients already resolve at 11.x.

Overview
Raises uuid from ^9.0.1 (and changelog references from older ranges) to ^11.1.1 on the root devDependency and across controller/utils packages, with matching yarn.lock and Unreleased changelog entries. This targets the patched line for advisory GHSA-w5hq-g745-h8pq without jumping to ESM-only v12+, which the PR notes would break Jest’s requireActual('uuid') pattern.

@types/uuid is removed from the manifests that had it, since uuid ≥ v10 ships its own types.

The only non-manifest code change is in packages/utils/src/fs.test.ts: tests mock v4 via a jest.fn wrapper and a mockUuidV4 helper instead of jest.spyOn on a namespace import, avoiding v4’s overload typing returning Uint8Array when spied.

^{Reviewed by Cursor Bugbot for commit 197dee5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cryptodev-2s]

@metamaskbot update-changelogs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	uuid@​11.1.1

View full report

[metamask-ci]

✅ Changelogs updated and pushed.

[mcmire]

Checked over uuid's changelog and there doesn't seem to be any changes that impact us. LGTM.