fix: resolve uuid to 11.1.1 in React-Native example

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-19.
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
uuid (examples/React-Native, transitive)	npm	Major	7.0.3 / 8.3.2 → 11.1.1	Medium	150d	Dependabot, Wiz	GHSA-w5hq-g745-h8pq

Implemented as yarn resolutions (uuid@^7.0.3, uuid@^8.0.0, uuid@^8.3.2 → 11.1.1, matching the existing pattern in that package.json) plus the regenerated yarn.lock. No source changes. The parents that pin uuid ^7/^8 (xcode, @expo/rudder-sdk-node, @expo/bunyan, @expo/code-signing-certificates) only use the CommonJS named exports require('uuid').v4 / .v1, which uuid 11 still provides. The Expo 57 upgrade in #18 would be the longer-term way to drop these old parents.

Deferred / excluded findings

• Excluded — needs owning-team work (major bump of a transitive that breaks its parent)
  • image-size 1.2.1 → 2.0.3: High, 25d (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq). There's no 1.x fix. metro 0.81.4 calls require("image-size")(...) as a function, but in 2.x that export is an object ({ imageSize, default, ... }), so asset bundling would break. Every Metro release up to 0.83 pins image-size ^1.0.2, and only 0.87+ drops it. The fix is an Expo/React Native upgrade (React Native example: Expo 57 / TS 7 / Babel 8 upgrade + Observability + funnel experiment + CI #18).
• No fix version available yet: node-forge 1.4.0, braces 3.0.3, sprintf-js 1.1.3, Wiz http-cache-semantics; Wiz end-of-life library findings for glob, rimraf, inflight and the @babel/plugin-proposal-* plugins.
• Low severity, out of scope: @babel/core (GHSA-4x5r-pxfx-6jf8).
• Minor/patch findings (next and shell-quote Criticals, @xmldom/xmldom, browserslist, js-yaml, qs, ip-address, undici, brace-expansion) are covered by fix: bump next, shell-quote, @xmldom/xmldom, browserslist, js-yaml, qs, ip-address, undici and brace-expansion to patched versions #22; compression 1.8.2 and next 16.3.8 are still in the 7-day hold.

Verification

2026-10-19: branch is 0 commits behind main (unchanged since the 2026-10-05 verification below), so no re-merge was needed. Wiz MCP was unavailable this run (Dependabot-only).

• Install: ✅ yarn install (Yarn 3.4.1 via @yarnpkg/cli-dist, Node 24) in examples/React-Native
• Build: ✅ npx tsc --noEmit; ✅ npx expo export --platform android and --platform ios (with a placeholder MOBILE_KEY in an uncommitted .env). Runtime smoke test: xcode parsed a real .pbxproj, ran generateUuid()/addPbxGroup() and wrote it back; uuid.v4()/v1() and @expo/rudder-sdk-node load fine. npx expo prebuild --platform ios fails identically on main (existing tar 7 resolution), unrelated to this change.
• Tests: n/a (the example has no test suite)
• Lint: n/a (no lint config for the React-Native example)

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring