Resolved CVE-2026-41907 and CVE-2026-8723.

[AWSHurneyt]

Resolved CVE-2026-41907 and CVE-2026-8723.

CVEs Addressed

• CVE-2026-41907 (uuid): v3/v5/v6 buffer bounds not validated, allowing silent partial writes. Fixed by bumping to uuid@14.0.0.
• CVE-2026-8723 (qs): qs.stringify throws TypeError with arrayFormat:'comma' + encodeValuesOnly:true on null/undefined array entries. Fixed by bumping to qs@6.15.2.

Changes

• Added uuid: ^14.0.0 resolution to package.json
• Added qs: ^6.15.2 resolution to package.json
• Added vega mock to jest moduleNameMapper (pre-existing test fix)
• Added uuid to transformIgnorePatterns exception for ESM compatibility
• Added crypto polyfill for jsdom test environment (uuid@14 requires it)
• Updated yarn.lock

[AWSHurneyt]

The cypress test workflows are failing to run due a build failure in the backend plugin
https://github.com/opensearch-project/security-analytics-dashboards-plugin/actions/runs/26479659166/job/77973758634?pr=1531#step:5:72