Skip to content

fix(deps): resolve 14 Snyk vulnerabilities via upgrades and overrides - #71

Merged
cs-raj merged 4 commits into
mainfrom
fix/snyk-vulnerability-resolution
Oct 29, 2026
Merged

fix(deps): resolve 14 Snyk vulnerabilities via upgrades and overrides#71
cs-raj merged 4 commits into
mainfrom
fix/snyk-vulnerability-resolution

Conversation

@cs-raj

@cs-raj cs-raj commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

Snyk reports 8 findings on main (2 critical, 6 high), all in undici 8.12.1, which comes in through isomorphic-dompurify → jsdom. npm audit reports 1 high. This PR had fallen behind main and conflicted with it.

Fix

APP: the lock file is what ships, so regenerating it is a real fix.

  • Merged main into this branch, keeping the newer value on each conflicting line: next ^16.4.1 and the sharp 0.35.5 override from main; react/react-dom ^19.3.0 and the qs ^6.16.0, js-yaml ^4.3.2 and undici ^8.10.2 overrides from this PR.
  • Regenerated package-lock.json: undici now resolves to 8.12.3, which clears all 8 findings. No new bumps or overrides, no version change.

What remains

  • 10 LGPL-3.0 licence findings on @img/sharp-libvips-* (a licence, not a vulnerability; sharp comes with next).

Verification: Snyk 8 → 0, npm audit 1 → 0; next build compiles and typechecks, page-data collection needs Contentstack credentials (same on main).

🤖 Generated with Claude Code

@cs-raj @claude
fix(deps): resolve 14 Snyk vulnerabilities via upgrades and overrides
e8a4436 
Clears all 14 Snyk security findings (2 critical, 7 high, 5 moderate) and
all 6 npm audit findings. Every vulnerability was transitive.

Upgrades next, react and react-dom within their existing majors, and adds
undici and js-yaml overrides. Raises the stale qs and sharp overrides,
which were pinning versions that had themselves become vulnerable.

No major version bumps. Snyk's suggested isomorphic-dompurify 4.0.0 major
was rejected in favour of a same-major undici override covering the same
11 findings.

The build failure on this branch is pre-existing and environmental: it
reproduces identically on unmodified main via npm ci, and is caused by
build-time Contentstack fetches requiring real credentials. TypeScript
and lint both pass on the upgraded tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@cs-raj
cs-raj requested a review from a team as a code owner September 10, 2026 13:04
@cs-raj cs-raj self-assigned this Sep 10, 2026
@snyk-io

snyk-io Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 20 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 20
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

netrajpatel
netrajpatel previously approved these changes Sep 10, 2026
View reviewed changes
amit-kanswal-cs
amit-kanswal-cs reviewed Sep 11, 2026
View reviewed changes

@amit-kanswal-cs amit-kanswal-cs left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

cs-raj and others added 2 commits October 26, 2026 20:29
@cs-raj
Merge remote-tracking branch 'origin/main' into fix/snyk-vulnerabilit…
9a5ed85 
…y-resolution

# Conflicts:
#	package-lock.json
#	package.json
@cs-raj @claude
fix: regenerate lock file to resolve Snyk vulnerabilities
51892ec 
Lock file regenerated (fixed 8 on its own): undici 8.12.1 -> 8.12.3.
Direct upgrades: none (next resolves 16.4.3 within ^16.4.1)
Overrides: none added
Vuln count: snyk 8 → 0, npm audit 1 → 0. Build: compile and TypeScript pass; page-data collection needs Contentstack credentials, same failure on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 20 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 20
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@cs-raj @claude
fix: regenerate lock file to resolve Snyk vulnerabilities
268b3c9 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 20 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 20
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@cs-raj
cs-raj merged commit 62babd9 into main Oct 29, 2026
7 checks passed
@cs-raj
cs-raj deleted the fix/snyk-vulnerability-resolution branch October 29, 2026 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@netrajpatel netrajpatel netrajpatel approved these changes
@aniket-shikhare-cstk aniket-shikhare-cstk aniket-shikhare-cstk left review comments
@amit-kanswal-cs amit-kanswal-cs amit-kanswal-cs left review comments

Assignees

@cs-raj cs-raj

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@cs-raj @netrajpatel @aniket-shikhare-cstk @amit-kanswal-cs