Security Audit & Remediation: eventarc

[inlined]

Security Audit & Remediation: eventarc

A. Previous CVEs

• GHSA-w5hq-g745-h8pq - uuid (Severity: Moderate)

B. Changes Made

• Removed unmaintained trivial wrapper uuid and refactored call sites in src/eventarc/eventarc-utils.ts to use native Node.js runtime stdlib crypto.randomUUID()

C. Remaining CVEs

• None within eventarc unit scope. (Transitive dev/optional CVEs in validator, tough-cookie, teeny-request, tar, vinyl-fs, z-schema affect root dev/optional dependencies with no impact on eventarc).

D. Introduced CVEs

• None

E. Testing Strategy

• Ran existing unit test suite (npx mocha ... --grep "eventarc-utils") - 100% passing.
• Executed automated linter (npm run lint:src).

[gemini-code-assist]

Code Review

This pull request replaces the external uuid library dependency with Node's built-in crypto module, updating the CloudEvent ID generation to use crypto.randomUUID(). There are no review comments, and I have no feedback to provide.

[inlined]

Closing because origin/main already contains this remediation (randomUUID from node:crypto).