fix(agentex-ui): bump uuid 11.1.0 -> 11.1.1 (CVE-2026-41907)

[scale-prodsec]

Summary

Bumps the direct dependency uuid in agentex-ui from 11.1.0 → 11.1.1 to remediate a vulnerability flagged by Trivy on the golden/agentex-ui container image.

• Package: uuid (node-pkg, direct dependency)
• Before → After: 11.1.0 → 11.1.1
• Service/dir: agentex-ui/ (built by agentex-ui/Dockerfile via npm ci)

CVEs closed

• CVE-2026-41907 (MEDIUM) — uuid: out-of-bounds write vulnerability impacting data integrity and confidentiality (GHSA-w5hq-g745-h8pq)

Fixed versions upstream are 11.1.1, 12.0.1, 13.0.1; this PR takes the lowest fix (11.1.1), which stays on the same major and requires no code changes.

How verified

• uuid constraint raised to ^11.1.1 in agentex-ui/package.json; agentex-ui/package-lock.json refreshed with npm install --package-lock-only.
• Lock now resolves node_modules/uuid to 11.1.1; the vulnerable uuid-11.1.0.tgz is gone from the lockfile and the installed tree.
• Diff limited to the uuid entry only (lockfileVersion: 3 preserved).
• CI gate: npm ci succeeds against the new lock; installed uuid is 11.1.1.

Linear

Resolves GFDVR-17705 (child: GFDVR-17709).

🤖 Generated with Claude Code

Greptile Summary

This PR bumps the uuid direct dependency in agentex-ui from 11.1.0 to 11.1.1 to remediate CVE-2026-41907 (GHSA-w5hq-g745-h8pq), an out-of-bounds write vulnerability in the v3/v5/v6 buffer APIs. The change is minimal and isolated to the uuid package entry.

• agentex-ui/package.json: version constraint raised from ^11.1.0 to ^11.1.1
• agentex-ui/package-lock.json: lock entry updated to 11.1.1 with new integrity hash; a license: "MIT" field is also added (pulled from updated registry metadata, expected)

Confidence Score: 5/5

Safe to merge — this is a single-package patch bump with no API changes required and a verified fix for the flagged CVE.

The diff is limited to the uuid package entry in package.json and package-lock.json. The CVE (out-of-bounds write in buffer-accepting uuid APIs) is confirmed real and fixed in 11.1.1. The integrity hash in the lockfile is consistent with the new version, lockfileVersion 3 is preserved, and no other packages are affected. The extra license field added to the lockfile is standard registry metadata included by npm for this release.

No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	uuid constraint bumped from ^11.1.0 to ^11.1.1 to require the patched version; no other changes
agentex-ui/package-lock.json	Lock entry for uuid updated to 11.1.1 with correct integrity hash; lockfileVersion 3 preserved; only uuid entry changed plus addition of license field from registry metadata

_{Reviews (1): Last reviewed commit: "fix(agentex-ui): bump uuid 11.1.0 -> 11...." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​uuid@​11.1.0 ⏵ 11.1.1	+1	+2	+1

View full report