From bfb1be23052e42878d33e892294c0004e8949a71 Mon Sep 17 00:00:00 2001
From: Nick Rolfe <nickrolfe@github.com>
Date: Fri, 10 Jul 2026 10:20:59 +0100
Subject: [PATCH] Override uuid to 11.1.1 to fix vulnerability

The vulnerable uuid@8.3.2 was pulled in transitively by @azure/msal-node.
Force the resolution to 11.1.1 via an npm override.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c9765432-b317-4939-8e5c-33df6b815f5f
---
 extensions/ql-vscode/package-lock.json | 24 ++++++++++++++----------
 extensions/ql-vscode/package.json      |  3 ++-
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/extensions/ql-vscode/package-lock.json b/extensions/ql-vscode/package-lock.json
index 8798b46231d..58b147624e4 100644
--- a/extensions/ql-vscode/package-lock.json
+++ b/extensions/ql-vscode/package-lock.json
@@ -455,16 +455,6 @@
         "node": ">=16"
       }
     },
-    "node_modules/@azure/msal-node/node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/@azure/opentelemetry-instrumentation-azure-sdk": {
       "version": "1.0.0-beta.5",
       "resolved": "https://registry.npmjs.org/@azure/opentelemetry-instrumentation-azure-sdk/-/opentelemetry-instrumentation-azure-sdk-1.0.0-beta.5.tgz",
@@ -29184,6 +29174,20 @@
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "dev": true
     },
+    "node_modules/uuid": {
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/esm/bin/uuid"
+      }
+    },
     "node_modules/v8-compile-cache-lib": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz",
diff --git a/extensions/ql-vscode/package.json b/extensions/ql-vscode/package.json
index 4687b260438..7b11258ee76 100644
--- a/extensions/ql-vscode/package.json
+++ b/extensions/ql-vscode/package.json
@@ -2198,7 +2198,8 @@
   "overrides": {
     "d3-graphviz": {
       "@hpcc-js/wasm": "2.30.0"
-    }
+    },
+    "uuid": "11.1.1"
   },
   "lint-staged": {
     "./**/*.{json,css,scss}": [