fix(gremlin-js): bump uuid ^9.0.1 → ^11.1.1 to fix GHSA-w5hq-g745-h8pq

[vavsab]

What

Bumps the uuid dependency in gremlin-javascript from ^9.0.1 to ^11.1.1.

Why

uuid < 11.1.1 is affected by GHSA-w5hq-g745-h8pq — a missing buffer bounds check in v3/v5/v6 UUID generation when a user-supplied buf argument is provided. The advisory is rated moderate severity.

Change

- "uuid": "^9.0.1"
+ "uuid": "^11.1.1"

package-lock.json updated accordingly. No other changes.

[vavsab]

@spmallette Could you pls merge and release this PR?

[Cole-Greer]

@vavsab Thanks for opening this PR. It would be ideal to target this PR to 3.7-dev to get the fix included in both 3.7.7 and 3.8.2. Would you be willing to retarget the PR? Otherwise, I could help with cherry-picking it back upon merging.

VOTE +1

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.53%. Comparing base (4722890) to head (9249e02).
⚠️ Report is 3 commits behind head on 3.7-dev.

Additional details and impacted files

@@              Coverage Diff              @@
##             3.7-dev    #3459      +/-   ##
=============================================
+ Coverage      75.49%   75.53%   +0.03%     
- Complexity     13161    13165       +4     
=============================================
  Files           1092     1092              
  Lines          67208    67208              
  Branches        7391     7391              
=============================================
+ Hits           50742    50763      +21     
+ Misses         13837    13816      -21     
  Partials        2629     2629              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vavsab]

@vavsab Thanks for opening this PR. It would be ideal to target this PR to 3.7-dev to get the fix included in both 3.7.7 and 3.8.2. Would you be willing to retarget the PR? Otherwise, I could help with cherry-picking it back upon merging.

VOTE +1

@Cole-Greer ✅ Done!