fix: remove unused uuid dependency from api-graphql, predictions, and interactions

[AdrianoNicolucci]

Summary

Removes the direct uuid dependency from packages that don't need it, consolidating all UUID generation through @aws-amplify/core's amplifyUuid wrapper. This addresses the security advisory GHSA-w5hq-g745-h8pq.

Motivation

Dependabot flagged uuid for an out-of-bounds write vulnerability in v3(), v5(), and v6() when a caller-supplied buffer has an invalid offset. While this project only uses v4() (which is not affected), the cleanest resolution is to remove the unnecessary direct dependency from packages that never use it, and consolidate through core.

Changes

Package	Change
@aws-amplify/api-graphql	Removed uuid from dependencies — was never imported directly (uses amplifyUuid from core)
@aws-amplify/predictions	Removed uuid from dependencies — was never imported anywhere in the package
@aws-amplify/interactions	Replaced direct import { v4 as uuid } from 'uuid' with amplifyUuid from @aws-amplify/core/internals/utils, then removed uuid from dependencies

After these changes, uuid exists only as a dependency in @aws-amplify/core (^11.0.0), which is the single package that wraps uuid.v4() via amplifyUuid.

Why not upgrade to uuid@14?

uuid@12+ dropped CommonJS support. Since amplify-js builds both CJS and ESM outputs with uuid kept as an external (not bundled), upgrading would break the CJS build at runtime. Staying on v11 is safe because only v4() is used, which is unaffected by the vulnerability.

Testing

• No behavioral change — amplifyUuid() is already a direct re-export of uuid.v4()
• The interactions package already imports from @aws-amplify/core/internals/utils for getAmplifyUserAgentObject, so this follows the existing pattern

[changeset-bot]

🦋 Changeset detected

Latest commit: c7015ef

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@aws-amplify/api-graphql	Patch
@aws-amplify/interactions	Patch
@aws-amplify/predictions	Patch
@aws-amplify/api	Patch
@aws-amplify/datastore	Patch
aws-amplify	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[soberm]

Thank you for your contribution! There is another file that still uses uuid:

amplify-js/packages/interactions/__tests__/lex-v2/AWSLexV2Provider.test.ts

Line 13 in 8bf7c89

import { v4 as uuid } from 'uuid';

Additionally, please make sure to add a changeset.

[AdrianoNicolucci]

Thank you for your contribution! There is another file that still uses uuid:

amplify-js/packages/interactions/__tests__/lex-v2/AWSLexV2Provider.test.ts

Line 13 in 8bf7c89

import { v4 as uuid } from 'uuid';

Additionally, please make sure to add a changeset.

Done

[bobbor]

LGTM. let's do this