fix(deps): vuln uuid (major → 14.0.2) [packages/react-native-babel-plugin/package.json]

[gh-worker-campaigns-3e9aa4]

Summary: Security update — 1 package upgraded (MAJOR changes included)

Manifests changed:

• packages/react-native-babel-plugin/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
uuid	8.3.2	14.0.2	major	Direct	3 MEDIUM

---

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

• Review the changelog/release notes for breaking changes
• Test thoroughly in a staging environment
• Update any code that depends on changed APIs
• Ensure all tests pass before merging

Security Details

ℹ️ Other Vulnerabilities (3)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
uuid	GHSA-w5hq-g745-h8pq	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	8.3.2	11.1.1	-
uuid	CVE-2026-41907	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	8.3.2	-	-
uuid	CVE-2026-41988	MODERATE	-	8.3.2	-	-

---

Review Checklist

Extra review is recommended for this update:

• Review changes for compatibility with your code
• Check release notes for breaking changes
• Run integration tests to verify service behavior
• Test in staging environment before production
• Monitor key metrics after deployment
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[Copilot]

Pull request overview

Security update upgrading uuid to address reported vulnerabilities.

Changes:

• Upgrades uuid from 8.3.2 to 14.0.2.
• Refreshes yarn.lock and related transitive resolutions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Review
yarn.lock	Updated dependency resolution.
packages/react-native-babel-plugin/package.json	Critical: uuid 14 is ESM-only, but the package publishes CommonJS and may fail with ERR_REQUIRE_ESM. Use a CommonJS-compatible implementation or crypto.randomUUID(), and add a smoke test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with develop — rebased onto df00559.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

packages/react-native-babel-plugin/package.json:53

• uuid 14 is ESM-only, but this package still publishes main: lib/commonjs/index and the Bob configuration builds a CommonJS target. That target will emit a require('uuid'), which fails with ERR_REQUIRE_ESM when Babel or the datadog-generate-sr-assets CLI loads the published package. The Jest setup transforms uuid, so the existing tests can hide this published-runtime failure. Keep a CJS-compatible uuid line or migrate the package and its CommonJS consumers to ESM, then verify the built artifact.

        "uuid": "^14.0.2"