diff --git a/moon/pnpm-lock.yaml b/moon/pnpm-lock.yaml
index ae47c12ba..217602ecb 100644
--- a/moon/pnpm-lock.yaml
+++ b/moon/pnpm-lock.yaml
@@ -580,8 +580,8 @@ catalogs:
       specifier: ^10.1.1
       version: 10.1.1
     uuid:
-      specifier: ^9.0.1
-      version: 9.0.1
+      specifier: ^14.0.0
+      version: 14.0.1
     vaul:
       specifier: ^1.1.2
       version: 1.1.2
@@ -711,7 +711,7 @@ importers:
         version: 4.4.0(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)
       '@hookform/resolvers':
         specifier: 'catalog:'
-        version: 5.4.2(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@6.15.0))(ajv@6.15.0)(react-hook-form@7.83.0(react@19.2.8))(zod@4.4.3)
+        version: 5.4.2(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(react-hook-form@7.83.0(react@19.2.8))(zod@4.4.3)
       '@mui/icons-material':
         specifier: 'catalog:'
         version: 7.3.11(@mui/material@7.3.11(@emotion/react@11.14.0(@types/react@19.2.17)(react@19.2.8)(supports-color@8.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.2.17)(react@19.2.8)(supports-color@8.1.1))(@types/react@19.2.17)(react@19.2.8)(supports-color@8.1.1))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@types/react@19.2.17)(react@19.2.8)
@@ -1014,7 +1014,7 @@ importers:
         version: 10.1.1(react@19.2.8)
       uuid:
         specifier: 'catalog:'
-        version: 9.0.1
+        version: 14.0.1
       vaul:
         specifier: 'catalog:'
         version: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
@@ -1234,7 +1234,7 @@ importers:
         version: 5.3.0
       uuid:
         specifier: 'catalog:'
-        version: 9.0.1
+        version: 14.0.1
     devDependencies:
       '@gitmono/eslint-config':
         specifier: workspace:*
@@ -10186,9 +10186,8 @@ packages:
   utila@0.4.0:
     resolution: {integrity: sha512-Z0DbgELS9/L/75wZbro8xAnT50pBVFQZ+hUEueGDU5FN51YSCYM+jdxsfCiHjwNP/4LCDD0i/graKpeBnOXKRA==}
 
-  uuid@9.0.1:
-    resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
-    deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
+  uuid@14.0.1:
+    resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==}
     hasBin: true
 
   vary@1.1.2:
@@ -11778,14 +11777,14 @@ snapshots:
       y-prosemirror: 1.3.7(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.2)(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)
       yjs: 13.6.31
 
-  '@hookform/resolvers@5.4.2(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@6.15.0))(ajv@6.15.0)(react-hook-form@7.83.0(react@19.2.8))(zod@4.4.3)':
+  '@hookform/resolvers@5.4.2(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(react-hook-form@7.83.0(react@19.2.8))(zod@4.4.3)':
     dependencies:
       '@standard-schema/utils': 0.3.0
       react-hook-form: 7.83.0(react@19.2.8)
     optionalDependencies:
       '@standard-schema/spec': 1.1.0
-      ajv: 6.15.0
-      ajv-formats: 2.1.1(ajv@6.15.0)
+      ajv: 8.20.0
+      ajv-formats: 2.1.1(ajv@8.20.0)
       zod: 4.4.3
 
   '@humanfs/core@0.19.2':
@@ -14748,11 +14747,6 @@ snapshots:
       loader-utils: 2.0.4
       regex-parser: 2.3.1
 
-  ajv-formats@2.1.1(ajv@6.15.0):
-    optionalDependencies:
-      ajv: 6.15.0
-    optional: true
-
   ajv-formats@2.1.1(ajv@8.20.0):
     optionalDependencies:
       ajv: 8.20.0
@@ -19900,7 +19894,7 @@ snapshots:
 
   utila@0.4.0: {}
 
-  uuid@9.0.1: {}
+  uuid@14.0.1: {}
 
   vary@1.1.2: {}
 
diff --git a/moon/pnpm-workspace.yaml b/moon/pnpm-workspace.yaml
index 13800098a..681f4e474 100644
--- a/moon/pnpm-workspace.yaml
+++ b/moon/pnpm-workspace.yaml
@@ -33,7 +33,7 @@ minimumReleaseAge: 0
 # - @primer/react + @primer/primitives: ^38 / ^11 (upgraded together)
 # - @shopify/react-shortcuts: ^5.2.0 — latest; peer still react<19 (allowed via peerDependencyRules)
 # - nextjs-cors: ^2.2.1 — latest; peer declares next<=14 (allowed via peerDependencyRules)
-# - uuid: ^9.0.1 — uuid 10+ is pure ESM, breaks CJS/tsup consumers
+# - uuid: ^14.0.0 — uuid 10+ is pure ESM, breaks CJS/tsup consumers
 # - swagger-typescript-api: ^12.0.4 — v13 CLI/output breaking
 # - @mui/x-tree-view: pin 8.5.0 — newer 8.x tightens TreeViewDefaultItemModelProperties (no content_type)
 # - @mui/material|icons-material: ^7.3 — not v9
@@ -226,7 +226,7 @@ catalog:
   turbo: ^2.10.6
   typescript: ^5.9.3 # not v7
   use-debounce: ^10.1.1
-  uuid: ^9.0.1 # not v10+ ESM
+  uuid: ^14.0.0 # not v10+ ESM
   vaul: ^1.1.2
   vitest: ^4.1.10
   yjs: ^13.6.31