Skip to content

fix(deps): resolve Snyk and npm audit vulnerabilities - #81

Merged
cs-raj merged 4 commits into
mainfrom
fix/snyk-vulnerability-resolution
Oct 29, 2026
Merged

fix(deps): resolve Snyk and npm audit vulnerabilities#81
cs-raj merged 4 commits into
mainfrom
fix/snyk-vulnerability-resolution

Conversation

@cs-raj

@cs-raj cs-raj commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

Snyk reports 9 vulnerable dependency findings (2 critical, 7 high) on main: 8 in undici 8.12.1 and 1 in qs 6.16.0. This repo is an APP (Next.js), so the lock file is what ships.

Fix

  • Merged main into this branch. The PR's older override pins are superseded: sharp takes main's 0.35.5, and the undici 8.10.2 and js-yaml 4.3.2 pins are dropped (undici 8.10.2 is below the 8.12.2 fix, and main already resolves js-yaml 4.3.2).
  • Regenerated package-lock.json: undici 8.12.1 -> 8.12.3 clears all 8 undici findings.
  • Raised the existing qs override 6.16.0 -> 6.16.1 (same major, in the shipped tree).
  • No direct dependency or package version change.

Remaining

  • 11 LGPL/MPL licence findings (@img/sharp-libvips-*, lightningcss-linux-x64-gnu), which a version bump does not fix.

Verification

Snyk 9 -> 0, npm audit 1 -> 0; npm run build passes.

🤖 Generated with Claude Code

@cs-raj @claude
fix(deps): resolve Snyk and npm audit vulnerabilities
4aa4af5 
Clear all 14 security findings reported by Snyk (2 critical, 7 high,
5 medium) and all 6 npm audit findings (3 high, 3 moderate) by pinning
fixed transitive versions through the overrides block. No major version
bumps were applied.

- qs 6.15.3 -> 6.16.0 (resource exhaustion, uncaught exception)
- sharp 0.35.3 -> 0.35.4 (heap-based buffer overflow via libheif)
- undici -> 8.10.2 (improper certificate validation, origin validation
  error, request smuggling, cookie leakage and 5 more)
- js-yaml -> 4.3.2 (CPU exhaustion via empty merge sources)

Bump package version 1.2.2 -> 1.2.3.

Remaining 11 Snyk findings are LGPL-3.0 license notices on optional
platform binaries of sharp/libvips, not security vulnerabilities.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@cs-raj
cs-raj requested a review from a team as a code owner September 10, 2026 12:59
@snyk-io

snyk-io Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 21 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 21
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

netrajpatel
netrajpatel previously approved these changes Sep 10, 2026
View reviewed changes
amit-kanswal-cs
amit-kanswal-cs previously approved these changes Sep 11, 2026
View reviewed changes

@amit-kanswal-cs amit-kanswal-cs left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

cs-raj and others added 2 commits October 26, 2026 21:08
@cs-raj
Merge remote-tracking branch 'origin/main' into fix/snyk-vulnerabilit…
b864610 
…y-resolution
@cs-raj @claude
fix: regenerate lock file and raise qs override to resolve Snyk vulne…
9adbfd8 
…rabilities

Lock file regenerated (fixed 8 on its own: undici 8.12.1 -> 8.12.3).
Direct upgrades: none
Overrides: qs 6.16.0 -> 6.16.1
Vuln count: snyk 9 -> 0, npm audit 1 -> 0. Build verified passing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cs-raj
cs-raj dismissed stale reviews from amit-kanswal-cs and netrajpatel via 9adbfd8 October 26, 2026 15:52
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 21 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 21
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@cs-raj @claude
fix: regenerate lock file and raise qs override to resolve Snyk vulne…
db96a8d 
…rabilities

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 21 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 21
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@cs-raj
cs-raj merged commit da9a7b8 into main Oct 29, 2026
7 checks passed
@cs-raj
cs-raj deleted the fix/snyk-vulnerability-resolution branch October 29, 2026 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@netrajpatel netrajpatel netrajpatel approved these changes
@amit-kanswal-cs amit-kanswal-cs amit-kanswal-cs left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cs-raj @netrajpatel @amit-kanswal-cs