fix: update uuid to 11.1.1

[sebd0]

Summary

Clears the uuid finding (GHSA-w5hq-g745-h8pq, missing buffer bounds check in v3/v5/v6 when a buf is passed). Oneleet lists 13.0.1 as the fix, but the advisory is also fixed in 11.1.1, and 11.x is the last line that still ships a CommonJS build. Since dist/index.cjs does a plain require("uuid"), 13.x (ESM only) would break CommonJS consumers of the SDK, so 11.1.1 is the right target. The code only uses v4 and validate, both unchanged across 9 -> 11.

Stacked on the ws branch (#58) because both touch package-lock.json; GitHub retargets it to main once #58 merges.

Changes

• uuid ^9.0.1 -> ^11.1.1 (package.json and lock)

Testing

npm ci, npm run lint and npm run build pass. Both build outputs load: require("./dist/index.cjs") and import("./dist/index.js") resolve uuid and export the SDK. npm test has the same 10 failing files as main (heartbeat and connection suites, red on main since June), no change in the set.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. To trigger a review, include coderabbit-review in the PR description. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2513c96c-e068-408d-a4e9-cd1a0e079ec2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}