fix(deps): resolve uuid to ^11.1.1 to address CVE-2026-41907 in v5

[osama-rizk]

Issue

Closes part of #14827.

A fresh install of aws-amplify@^5 still pulls a vulnerable uuid@3.4.0 transitively:

% npm why uuid | grep uuid
uuid@3.4.0
  uuid@"^3.2.1" from @aws-amplify/analytics
  uuid@"^3.2.1" from @aws-amplify/api-graphql
  uuid@"3.4.0"  from @aws-amplify/datastore
  uuid@"^3.2.1" from @aws-amplify/notifications
  uuid@"^3.2.1" from @aws-amplify/predictions
  uuid@"^3.2.1" from @aws-amplify/pubsub
  uuid@"^3.0.0" from @aws-sdk/client-comprehend / client-translate / middleware-retry

uuid < 11.1.1 is affected by GHSA-w5hq-g745-h8pq (CVE-2026-41907) — the v3()/v5()/v6() methods skip bounds validation on caller-provided output buffers, allowing silent partial writes that can produce truncated/malformed identifiers.

The other items from #14827 — axios, js-cookie, fast-xml-parser, qs — were already addressed in #14832. uuid was the remaining gap.

Change

Add a root resolutions entry forcing uuid@^11.1.1, mirroring the v6 fix in #14828 (already released):

   "lodash": "^4.18.1",
-  "js-cookie": "^3.0.7"
+  "js-cookie": "^3.0.7",
+  "uuid": "^11.1.1"

After this, all uuid ranges collapse to a single resolved 11.1.1 in yarn.lock (the vulnerable 3.4.0 / 7.0.3 / 8.3.2 entries are removed).

Compatibility

uuid changed its import surface in v7 (named exports only), so I verified every import site in v5 source:

packages/*/src: import { v1 as uuid } from 'uuid';
                import { v4 as uuid } from 'uuid';
                import { v4 as uuid4 } from 'uuid';

All usages are named imports of v1/v4 — API-compatible from uuid v3 through v11. There are no default imports (import uuid from 'uuid') or uuid.v4() member-access patterns that v7+ removed, so no source changes are required. Confirmed require('uuid') in the installed 11.1.1 exposes v1/v3/v4/v5 as functions.

Notes

• Scope is intentionally minimal: only package.json + yarn.lock, only uuid entries change.
• Following the convention of the prior v5 security PR (fix: resolve dependency security vulnerabilities (axios, js-cookie, fast-xml-parser, qs) in v5 #14832), no changeset file is added (v5-stable does not use .changeset/).
• Pre-existing pubsub/api-graphql TypeScript build errors (symbol index types) on v5-stable are unrelated to this change — they reproduce on a pristine v5-stable checkout (introduced by the Node 24 toolchain bump in chore: bump node from 18/22 to 24 in v5 #14784) and are unaffected by this resolution.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3a1afa5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[soberm]

uuid is direct dependency of multiple Amplify packages. A resolution will not work.

[osama-rizk]

Good catch, thanks @soberm — you're right. A root resolutions entry only affects this monorepo's own install and isn't published, so consumers running npm install aws-amplify@5 would still resolve the vulnerable uuid@3.4.0 via each package's declared range.

I've pushed a new commit that bumps uuid to ^11.1.1 as a direct dependency in every package that declares it — analytics, api-graphql, datastore, notifications, predictions, pubsub — and removed the root resolution. I also bumped datastore's @types/uuid 3.4.6 → ^9.0.0 (the v3 types describe a default export that no longer exists in v11), matching what v6 does.

All source uses named imports ({ v1 }/{ v4 }), which are API-compatible from uuid v3 through v11, so no source changes were needed. PTAL 🙏