# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Resolve Dependabot alert https://github.com/giselles-ai/giselle/security/dependabot/175
  (GHSA-w5hq-g745-h8pq: uuid v3/v5/v6 missing buffer bounds check, fixed in 14.0.0).

## Goal (incl. success criteria)

- The lockfile carries `uuid >= 14.0.0` only; alert closes; no runtime regression
  from the ESM-only major version bump.

## Constraints/Assumptions

- Single vulnerable copy in the lockfile: `uuid@9.0.1` (transitive).
- Consumers: `gaxios` (CJS), `@sentry/webpack-plugin` (dual), `@trigger.dev/sdk`
  (ESM), `googleapis` chain. All call only `v4()` — no v3/v5/v6 with `buf`,
  so the actual exploit path is unreachable for this codebase. The bump is for
  alert/compliance, not for closing a real vulnerability path.
- `uuid@14.0.0` is ESM-only (`"type": "module"`). gaxios does
  `const uuid_1 = require("uuid")` from CJS, so the runtime relies on Node 24's
  default `require(esm)` support. CLAUDE.md pins the project to Node `>=24`.

## Key decisions

- pnpm override `"uuid@<14.0.0": "14.0.0"` matching the existing scoped-override
  style. No catalog change needed (no direct consumer in workspace package.json).
- Verified the CJS interop path with a local smoke test:
  ```bash
  cd node_modules/.pnpm/gaxios@6.7.1/node_modules/gaxios
  node -e "const u = require('uuid'); console.log(u.v4()); console.log(Object.keys(u))"
  # -> valid UUID; keys include v1..v7, parse, stringify, MAX, NIL
  ```

## State

- `pnpm install --lockfile-only` collapsed `uuid` to a single 14.0.0.
- `pnpm format / build-sdk / check-types / test` all green.

## Done

- package.json: added `"uuid@<14.0.0": "14.0.0"` override.
- pnpm-lock.yaml: regenerated; only `uuid@14.0.0` remains.

## Now

- Commit, push, open PR.

## Next

- Watch CI; License Compliance workflow will refresh `docs/packages-license.md`
  automatically on this branch.

## Open questions (UNCONFIRMED if needed)

- None.

## Working set (files/ids/commands)

- package.json
- pnpm-lock.yaml
- Alert: https://github.com/giselles-ai/giselle/security/dependabot/175
- Advisory: https://github.com/advisories/GHSA-w5hq-g745-h8pq
