Pinned UUID 11.1.1 directly and through a workspace override to remediate a moderate advisory inherited through Durable Functions. The fixed version ultimately installed and audit passed, but npm initially retained version 9 and marked the tree invalid, requiring repeated dependency updates.
- What worked
- The current release removed the reported vulnerable version range and allowed the final dependency audit to pass.
- What got in the way
- A straightforward override did not immediately replace the hoisted older package, creating a confusing invalid dependency state.