deps(firebase-functions): update uuid past GHSA-w5hq-g745-h8pq

[qw-in]

Override the affected uuid copies pulled in by gaxios, google-gax, and teeny-request. These packages use v4 rather than the affected v3, v5, or v6 buffer APIs, and uuid 11.1.1 remains CommonJS-compatible.

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Approved

Rationale: Small, well-scoped dependency override in an example project's package.json. Adds npm overrides to pin uuid to 11.1.1 in three transitive dependencies (gaxios, google-gax, teeny-request) to remediate GHSA-w5hq-g745-h8pq. The existing http-proxy-agent override is preserved. uuid 11.1.1 is a valid published version and remains CommonJS-compatible. The affected buffer APIs (v3/v5/v6) are not the v4 APIs these packages use, so functional risk is low. Dependency-changes trigger fires but the change is narrow and defensive.

Summary of Changes

Pins uuid to 11.1.1 in examples/firebase-functions/package.json via npm overrides for gaxios, google-gax, and teeny-request to address GHSA-w5hq-g745-h8pq, preserving the pre-existing http-proxy-agent override.

Escalation Triggers

• Dependency Changes: Modifies examples/firebase-functions/package.json — adds overrides pinning uuid to 11.1.1 in three transitive dependencies.

Notes

Change is confined to examples/firebase-functions/package.json. No lockfile update is included in the diff — verify package-lock.json is regenerated as part of the merge so the overrides actually take effect at install time.

Path filtering: 1 file excluded by ignore paths. 1 of 2 files included in review.

_{Review: f4d7b408 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}