From 6b5100d50bac3851b659fb30a54725acfea74b6f Mon Sep 17 00:00:00 2001
From: Bernard Gatt <bernard@customer.io>
Date: Thu, 4 Jun 2026 08:12:54 +0200
Subject: [PATCH] Update uuid to v14 and remove @types/uuid

Resolves moderate severity vulnerability (GHSA-w5hq-g745-h8pq) in uuid
versions below 11.1.1. Also removes @types/uuid since uuid v14 ships its
own TypeScript types.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 package-lock.json | 23 +++++++++--------------
 package.json      |  3 +--
 2 files changed, 10 insertions(+), 16 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8c3dc21..2f81fba 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,11 +10,10 @@
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@customerio/jist": "^0.1.6",
-        "uuid": "^8.3.2"
+        "uuid": "^14.0.0"
       },
       "devDependencies": {
         "@eslint/js": "^9.13.0",
-        "@types/uuid": "^10.0.0",
         "eslint": "^9.13.0",
         "eslint-config-prettier": "^10.1.8",
         "eslint-plugin-prettier": "^5.5.5",
@@ -1318,13 +1317,6 @@
         "undici-types": ">=7.24.0 <7.24.7"
       }
     },
-    "node_modules/@types/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@typescript-eslint/eslint-plugin": {
       "version": "8.60.0",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.60.0.tgz",
@@ -6929,13 +6921,16 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
+      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist-node/bin/uuid"
       }
     },
     "node_modules/validate-npm-package-license": {
diff --git a/package.json b/package.json
index 26faed3..cc13eb6 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,6 @@
   "license": "SEE LICENSE IN LICENSE",
   "devDependencies": {
     "@eslint/js": "^9.13.0",
-    "@types/uuid": "^10.0.0",
     "eslint": "^9.13.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.5",
@@ -52,7 +51,7 @@
   },
   "dependencies": {
     "@customerio/jist": "^0.1.6",
-    "uuid": "^8.3.2"
+    "uuid": "^14.0.0"
   },
   "repository": {
     "type": "git",