Fix vulnerabilities in various package.json and Gemfile files

[SherfeyInv]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

---

Note

Low Risk
Changes are a direct dependency version bump and a test fixture pin; no production logic or auth flows are modified in the diff.

Overview
Bumps the root CLI dependency uuid from ^11.1.1 to ^14.0.0, aligning with existing package.json overrides that pin transitive uuid consumers to the same version.

Updates the snyk-fix pip-requirements acceptance workspace so pip-app/requirements.txt expects Django==3.2.14 instead of 1.6.1, keeping the update-dependencies test fixture in line with the remediated pin.

^{Reviewed by Cursor Bugbot for commit 6f42919. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 3 committers have signed the CLA.

✅ SherfeyInv
❌ snyk-bot
❌ Ron Sherfey

---

Ron Sherfey seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit 6f42919. Configure here.}

[cursor]

Fixture Django version breaks fix test

Medium Severity

The pip-app acceptance workspace now pins Django==3.2.14, but the fixes multiple files that are included via -r test still supplies remediation for django@1.6.1 and expects an upgrade to 2.0.1. Upgrade matching keys off the installed version, so the Django fix is skipped and assertions on write count and change messages fail.

 

^{Reviewed by Cursor Bugbot for commit 6f42919. Configure here.}

[cursor]

Lockfile still pins old uuid

Medium Severity

Root package.json now requires uuid ^14.0.0, but this commit does not update package-lock.json, which still resolves uuid to 11.1.1. CI flows using npm ci continue installing the older package, so the intended vulnerability bump may not take effect in automated builds.

 

^{Reviewed by Cursor Bugbot for commit 6f42919. Configure here.}