Under the hood
Device attestation status now validates session/checkout IDs as strict UUIDs
What
A constant used in device attestation status checks, which previously matched an ID by string prefix, is replaced with a strict regular expression that only matches a properly formatted UUID (a standard 36-character identifier format).
Why
This makes the check stricter: an ID has to be a well-formed UUID to pass, rather than merely starting with the right prefix, which should reduce the chance of a malformed or spoofed ID being accepted.