Repository navigation
fix(deps): resolve Snyk and npm audit vulnerabilities - #73
Merged
Merged
Conversation
Upgrade direct dependencies to the latest patch/minor releases and add overrides for transitive packages that cannot be fixed by a direct bump. Direct dependencies: - next 16.2.12 -> 16.3.4 - react / react-dom 19.2.8 -> 19.3.0 - eslint-config-next 16.2.12 -> 16.3.4 Overrides: - qs ^6.15.3 -> ^6.16.0 (resource exhaustion, uncaught exception) - sharp 0.35.3 -> 0.35.4 (heap-based buffer overflow via libheif) - undici ^8.10.2 (new; 2 critical, 5 high, 4 medium via jsdom) - js-yaml ^4.3.2 (new; CPU exhaustion via empty merge sources) Snyk security issues drop from 14 (2 critical, 7 high, 5 medium) to 0 and npm audit from 6 (3 high, 3 moderate) to 0. Remaining Snyk findings are LGPL-3.0 license notices on optional @img/sharp-libvips binaries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
netrajpatel
previously approved these changes
Sep 10, 2026
aniket-shikhare-cstk
previously approved these changes
Sep 10, 2026
…y-resolution Conflicts resolved to the newer value per line: next ^16.4.1 and sharp 0.35.5 from main; react/react-dom ^19.3.0 and qs ^6.16.0 from the PR; PR's undici ^8.10.2 and js-yaml ^4.3.2 overrides kept. package-lock.json taken from the PR side (regenerated next). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…k vulnerabilities Lock file regenerated (fixed 8 of 11 vs main on its own: undici 8.12.1 -> 8.12.3). Direct upgrades: none Overrides: dompurify 3.4.16 -> 3.4.17 (existing pin raised) Vuln count: snyk 11 → 0, npm audit 2 → 0. Build verified passing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cs-raj
dismissed stale reviews from amit-kanswal-cs, aniket-shikhare-cstk, and netrajpatel
via
October 26, 2026 15:40
46050d1
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
amit-kanswal-cs
previously approved these changes
Oct 27, 2026
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
netrajpatel
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Snyk reports 11 vulnerabilities on
main(3 critical, 7 high, 1 low):undici8.12.1 (8, viaisomorphic-dompurify > jsdom) anddompurify3.4.16 (3, pinned inoverrides). npm audit reports 2. This branch also predated #75 and conflicted withmain.Fix
APP (Next.js, built with
next build), so the lock file is the deliverable. No package version bump (already 1.2.4).maininto this branch, keeping the newer value on each conflicting line:next^16.4.1 andsharp0.35.5 frommain;react/react-dom^19.3.0 andqs^6.16.0 from this PR; this PR'sundici^8.10.2 andjs-yaml^4.3.2 overrides kept.package-lock.json:undici8.12.1 -> 8.12.3 clears 8 findings on its own.dompurifyoverride 3.4.16 -> 3.4.17 (the pin held the 3 open XSS findings).Remaining:
@img/sharp-libvips-*, MPL-2.0lightningcss-linux-x64-gnu): not fixable by a version bump.Verified:
npm run buildpasses (Next.js 16.4.3). Snyk 11 -> 0, npm audit 2 -> 0.🤖 Generated with Claude Code