fix(security): fix security issue in uuid via major version upgrade from 8.3.2 to 11.1.1 in shared-actions

[aikido-autofix]

Overview

Jira ticket: https://typeform.atlassian.net/browse/<TICKET_ID>

Upgrade uuid to fix buffer overflow vulnerability in v3(), v5(), and v6() functions that could write past buffer boundaries without proper bounds validation.

Changes

Testing

Security Impact — CVE vulnerabilities fixed by this PR

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.

Breaking Changes & Upgrade Impact

✅ Code not affected by breaking changes.

✅ No breaking changes from the uuid upgrade (8.3.2 => 11.1.1) affect this codebase.

The codebase uses uuid only indirectly through the analytics-node dependency, which uses v4() for generating random UUIDs. The breaking changes in uuid versions 9.x, 10.x, and 11.x are:

1. Node.js version support changes: The action runs on node24 (Node.js 24), which is newer than the uuid 11.x requirement of Node.js 16-20. However, Node.js 24 is backward compatible with packages targeting Node.js 16-20, so this is not a breaking change in practice.

2. Browser-specific changes (removal of minified UMD build, IE 11/Safari 10 support, msCrypto fallback): Not applicable - this is a GitHub Action running in Node.js environment, not a browser.

3. v1 and v7 internal refactoring: Not applicable - the codebase only uses v4() through analytics-node.

4. TypeScript port: Not applicable - the codebase is written in JavaScript and doesn't import uuid types directly.

The uuid package is used exclusively by analytics-node@6.2.0 for generating message IDs using v4(), and this functionality remains unchanged across all versions.

All breaking changes by upgrading uuid from version 8.3.2 to 11.1.1 (CHANGELOG)

Version	Description
9.0.0	Drop Node.js 10.x support
9.0.0	Remove the minified UMD build from the package
9.0.0	Drop IE 11 and Safari 10 support, remove msCrypto fallback, and no longer transpile browser build to ES2015
10.0.0	Drop Node.js 12 and 14 support, add Node.js 20 (update node support matrix to only support node 16-20)
11.0.0	Refactor v1 internal state and options logic
11.0.0	Refactor v7 internal state and options logic
11.0.0	Port to TypeScript
11.0.0	Update node support matrix (only support node 16-20)

Fix Details / Technical Implementation

🤖 Remediation details

Fix transitive uuid vulnerability via Yarn resolution

This PR remediates a security vulnerability in the transitive dependency uuid within shared-actions/send-deployment-event. The fix is applied via a resolutions entry in shared-actions/send-deployment-event/package.json and is reflected in the corresponding yarn.lock.

uuid

uuid@8.3.2 was pulled in transitively by the direct dependency analytics-node@6.2.0, which declares uuid@^8.3.2. The patched version (11.1.1) is a semver-major jump outside that range, and analytics-node@6.2.0 is the only published version of that package, so no parent bump could admit a safe uuid release. A Yarn resolutions entry pinning uuid to 11.1.1 was added as a last resort, forcing the lockfile to resolve uuid to the patched version regardless of the ^8.3.2 constraint declared by analytics-node.

Version changes

Package	From	To	Why updated
uuid	8.3.2	11.1.1	Direct CVE fix via resolutions override (transitive via analytics-node; no parent bump possible)

Docs

• Yes! ✋ I have updated the documentation.

For contributions to the Typeform/.github repo

Note: Please do not use this repository for new internal shared workflows and actions. Use https://github.com/Typeform/.github-private instead!

Please check that your contribution applies to one of these cases below. If this is not the case, please contribute to https://github.com/Typeform/.github-private instead.

• This PR only changes an existing workflow.
• This PR adds a new workflow that is needed in a public Typeform repository.

[pr-auditor]

✅ Security Analysis Results

No security issues found. 2 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team