[amit-kanswal-cs]

Snyk dependency fixes (DX-29607)

Repo type: LIBRARY. It is published to npm as gatsby-source-contentstack. Consumers resolve our package.json ranges themselves and never see this repo's package-lock.json or overrides. The lock-file changes here fix our own dev/CI/release install.

Fix

• package-lock.json updated in place from master's lock. Only the packages flagged by npm audit were updated, each within its existing semver range (npm update <pkgs> --package-lock-only). There are no major bumps and no package.json dependency changes.
  • 37 packages changed version and 4 were added. The 29 entries that went away are duplicate nested eslint copies that npm deduplicated.
  • The gatsby / gatsby-plugin-image / webpack / react peer tree is unchanged, so the lock keeps the same shape as master's.
  • A plain npm install on master fails with ERESOLVE. The existing override "gatsby": { "eslint": "9.26.0" } clashes with the devDependency eslint ^8.57.1, which eslint-config-airbnb@19 needs. The update was therefore run with --force, which only overrides that peer conflict and still records the peers. The override is unchanged.
• Version: patch bump 5.4.10 → 5.4.11. This repo maintains its package version.

npm audit (lock file), before → after

Severity	master	This PR
Critical	3	0
High	53	39
Moderate	8	5
Low	9	10
Total	73	54

What remains, and why

• query-string 7.x and decode-uri-component (high): query-string is a runtime dependency, so this reaches consumers. The fix needs query-string 10, a major ESM-only bump.
• undici and ip-address: bundled inside npm under @semantic-release/npm (dev/release only). Bundled dependencies cannot be overridden.
• The gatsby 5 dev tree (webpack / dev-server / graphql tooling) and the jest 29 chain: the remaining fixes are major-only or have no fixed release.
• Follow-up: drop or align the gatsby > eslint 9.26.0 override so a plain npm install works again.

Verification

• npm ci --force, then npm run build: passes (Babel compiled 25 files).
• jest: 6 suites and 16 tests pass.
• Snyk CLI was unavailable for the runner's account (403), so the numbers above come from npm audit. No Jira tickets were updated.

🤖 Generated with Claude Code

npm audit fix follow-up

• npm audit fix cannot run here: it fails with ERESOLVE because of the existing eslint override. The same in-range updates were applied with npm update --package-lock-only --force, which keeps the gatsby peer tree. npm audit goes 54 → 50 (high 39 → 35). npm ci, the build and jest (16/16) pass.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	0	✅ Passed
🔵 Low Severity	0	0	0	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	0	✅ Passed
🔵 Low Severity	0	0	0	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	1	10	✅ Passed
🟠 High Severity	1	56	25	✅ Passed
🟡 Medium Severity	0	59	500	✅ Passed
🔵 Low Severity	0	4	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	1	15 / 30 days	⚠️ Warning
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 1
• High without fixes: 56
• Medium without fixes: 59
• Low without fixes: 4

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	1	10	✅ Passed
🟠 High Severity	1	49	25	✅ Passed
🟡 Medium Severity	0	56	500	✅ Passed
🔵 Low Severity	0	4	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	1	15 / 30 days	⚠️ Warning
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 1
• High without fixes: 49
• Medium without fixes: 56
• Low without fixes: 4

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.